Controlling post-collision autonomous driving based on driver responsiveness

ABSTRACT

A system and method to avoid collisions on highways, and to minimize the fatalities, injury, and damage when a collision is unavoidable. The system includes sensor means to detect other vehicles, and computing means to evaluate when a collision is imminent and to determine whether the collision is avoidable. If the collision is avoidable by a sequence of controlled accelerations and decelerations and steering, the system implements that sequence of actions automatically. If the collision is unavoidable, a different sequence is implemented to minimize the overall harm of the unavoidable collision. The system further includes indirect mitigation steps such as flashing the brake lights automatically. An optional post-collision strategy is implemented to prevent secondary collisions, particularly if the driver is incapacitated. Adjustment means enable the driver to set the type and timing of automatic interventions.

PRIORITY CLAIMS AND RELATED APPLICATION

This application is a continuation of U.S. Ser. No. 17/204,028, filedMar. 17, 2021, which is a continuation of U.S. Ser. No. 17/175,472,filed Feb. 12, 2021, which is a continuation of U.S. Ser. No.17/026,707, filed Sep. 21, 202, which is a continuation of U.S. Ser. No.16/715,108, filed Dec. 16, 2019, which is a continuation of U.S. Ser.No. 16/114,950, filed Aug. 28, 2018, entitled “SYSTEMS AND METHODS FORHAZARD MITIGATION”, now U.S. Pat. No. 10,507,829, issued Dec. 17, 2019which is a continuation of U.S. Ser. No. 15/729,757 entitled “SYSTEMSAND METHODS FOR HAZARD MITIGATION” and filed Oct. 11, 2017, now U.S.Pat. No. 10,059,335, which is a continuation of U.S. Ser. No. 15/347,573entitled “SYSTEMS AND METHODS FOR HAZARD MITIGATION” and filed Nov. 9,2016, now U.S. Pat. No. 9,896,096, which claims the benefit of thefollowing U.S. Provisional Patent Application No. 62/390,847 entitled“Vehicle Collision Mitigation” and filed on Apr. 11, 2016; No.62/391,443 entitled “Vehicle Side Collision Mitigation” and filed onApr. 29, 2016; No. 62/392,003 entitled “Adjustable Driving Assistant”and filed on May 16, 2016; No. 62/392,010 entitled “VehiclePost-Collision Mitigation” and filed on May 17, 2016; No. 62/493,266entitled “Hazard Mitigation” and filed on Jun. 27, 2016; No. 62/494,750entitled “Hazard Mitigation” and filed on Aug. 18, 2016; the entiredisclosures of which are incorporated by reference as part of thespecification of this application.

FIELD OF THE INVENTION

The invention relates to methods and systems for avoiding collisionsinvolving motor vehicles, and for minimizing the destructiveness of suchcollisions when they are unavoidable.

BACKGROUND OF THE INVENTION

Each year 1.25 million people are killed worldwide in traffic accidents,including 35,000 in the US. Ninety percent are due to human error. Forexample, a common highway hazard occurs when heavy traffic suddenlyslows down. The car ahead is frantically braking or has already stopped,but the approaching drivers from behind are still unaware of theslowdown. Often the lanes on both sides are blocked. In this case, adriver must apply the brakes rapidly to avoid a collision, but not sorapidly that the car skids or that the car behind cannot stop in time.The problem gets worse for each subsequent driver in the lane, sincethere is less time for each driver to react due to the accumulated delaytimes of all the drivers in front. An alert driver can usually avoid acollision by skillfully braking, but there are times when it is simplynot possible to avoid a collision.

A second common hazard occurs when two cars are traveling insubstantially the same direction, and one car gradually approaches theother from the side, such as may occur during lane-change maneuvers, orwhile merging onto a multilane highway, or from driver inattention, orwhile swerving to avoid an obstacle, or for many other causes. One orboth drivers may be able to avoid a side-encroachment collision bybraking or swerving, but sometimes a collision is unavoidable. Often oneof the cars is in the “blind spot” of the other driver, and often one orboth drivers are unaware of the hazard until too late to avoid it. Notuncommonly, one of the drivers makes matters worse by taking such strongevasive action that the vehicle starts to skid.

A third important hazard develops after a collision has alreadyoccurred. The immediate post-collision period is extremely dangerousbecause other vehicles may be rapidly approaching, their drivers not yetaware of the problem. Often the drivers of collided vehicles aredisoriented and, at least temporarily, in no shape to manage thepost-collision hazards. Often the scene is chaotic, with cars strewnacross lanes at random angles. Especially in snow or fog, this may leadto a cascade sequence in which numerous vehicles unavoidably crash intothe tangled pile. The risk of fire is extreme. Many accident victims arerelatively unharmed in the initial accident, but are then seriouslyinjured or killed during the post-collision period, due to secondarycollisions or fire or for lack of timely assistance.

Prior art in this field includes numerous collision-avoidance schemesinvolving sensing the distance to the car in front and automaticallyapplying the brakes. However, such schemes may not leave enough time forthe next-following car to stop, resulting in a collision from behind.This situation becomes even more hazardous if the automatic systemapplies the brakes too aggressively so as to leave a large space infront, since this gives the following driver even less time to react.When a collision is unavoidable, prior-art systems generally adhere toan avoidance strategy despite its futility, which often results in worsedamage and injuries than otherwise.

A further limitation of prior art collision-avoidance systems is a lackof accounting for each driver's abilities. Often an alert driver withgood reflexes may be able to avoid a collision even better than theautomatic system. If the automatic system takes control away from such adriver, clearly the system would not be providing a benefit of any kind.Moreover, the skilled driver will probably resent having the controltaken away at the most critical moment, and will probably be angryknowing that he could have avoided the collision if the system hadallowed him to do so. Such a driver would likely disable the automaticsystem in response, thereby losing automatic assistance in a futureemergency in which he may need the help. Prior-art collision-avoidancesystems are typically just simple on-or-off, one-size-fits-all systems,offering no user-adjustable features. Clearly, such a system would notwork well for drivers having widely different skill levels.

What is needed is automatic means for recognizing traffic hazards,including in-lane hazards and side-encroachment hazards, and foravoiding collisions automatically when it is possible to do so, and forminimizing the harm or destructiveness of collisions when they areunavoidable. Preferably the system would also manage post-collisionhazards in real time. Preferably the system would be adjustable by thedriver to provide the level and type of intervention that the driverrequires.

SUMMARY OF THE INVENTION

As noted above, prior-art systems fail to provide a strategy forminimizing the fatalities and injuries and damage in situations when acollision is unavoidable, other than stupidly following acollision-avoidance strategy that is already known to fail. Simplylocking the brakes is not an effective strategy. Many of the above-notedfatalities, and innumerable injuries, would be avoided if an automaticsystem were available with an intelligent vehicle interventioncapability.

Accordingly, systems and methods according to present principles aredirected towards a system and method to avoid collisions when possible,and to minimize the harm of a collision when it is unavoidable. Thesystems and methods may be embodied in a non-transitorycomputer-readable medium, which includes instructions for causing acomputing environment to perform a method for mitigating vehiclecollisions. In one implementation, a method according to presentprinciples includes analyzing sensor data, detecting a second vehicle,and calculating whether a collision with the second vehicle can beavoided by implementing a set of sequential actions (a “sequence”) suchas braking or steering or positively accelerating the subject vehicle.If the collision can be so avoided, the collision is termed “avoidable”,and the sequence of actions is then implemented. If the collision cannotbe avoided by the sequence of actions, or by any other sequence analyzedby the system, then the collision is “unavoidable”, and a secondsequence of actions is prepared to minimize the harm caused by theunavoidable collision, and the second sequence is implemented. Theselected sequence of actions is implemented by sequentially controllingthe brakes, throttle, and steering of the subject vehicle according tothe second sequence. Preferably each sequence also specifies the timing,intensity, duration, and other parameters of each action in the sequenceas well. The sequence may further include actions other thanaccelerations such as illuminating brake lights and sending ahelp-request message. The system preferably informs the driver that anintervention is in progress, but preferably does not attempt to informthe driver of the specific steps of the sequence, since no human couldstudy the sequence fast enough to be of assistance. Also, the sequencemay be revised multiple times during the intervention due to changingcircumstances. Thus the sequence is implemented automatically andtransparently to the driver.

As an alternative method, a second vehicle may be detected using sensordata, and the position and velocity of the second vehicle could bederived from the sensor data by calculation. Then, the system couldproject the position and velocity of the second vehicle forward in timerelative to the subject vehicle, and determine whether a collision isimminent by determining if the projected path of the second vehicle andthat of the subject vehicle intersect or coincide or come within apredetermined radius of each other. If a collision is imminent, thesystem could repeat the projection but with a set of sequentialaccelerations applied to the subject vehicle. The analysis may includeassumptions such as constant velocity or constant acceleration of thesecond vehicle. If any such sequence is able to avoid the collision,that set of sequential accelerations would then be implemented. Multiplesequences may be tested in like manner. However, if none of thesequences is projected to avoid the collision, then the system couldimplement whichever sequence would produce the least harm. Additionalsequences may be tested even while a sequence is being implemented, tofurther reduce the expected harm or to keep trying to find a mostoptimized way to avoid the collision. If one of the additional sequencesis projected to avoid the collision, then the currently-implementedsequence would be stopped and the successful sequence would beimplemented instead. But if all of the sequences fail to avoid thecollision, then that sequence causing a minimum amount of harm would beimplemented.

In another variation, the second vehicle is detected with sensor data.The future positions of the subject vehicle and the second vehicle areprojected forward in time, but with the subject vehicle beingaccelerated according to a set of sequential actions. If the sequentialactions result in the vehicles passing safely and not colliding, thatsequence is implemented. If the sequence is projected to result in acollision, the harm caused by the collision is then calculated, based onthe projected velocities and contact points and other parameters of thecollision. The collision data and the estimated harm value are thenstored along with the sequence details. Then, if the collision remainsunavoidable after multiple sequences have been tested, aharm-minimization sequence is implemented instead. The harm-minimizationsequence may be selected by finding which of the previously-analyzedsequences would result in the least harm. Or, additional sequences maybe explored to further adjust the collision parameters and produce evenless harm.

A system according to present principles comprises one or more sensorsand one or more processor components configured to mitigate collisions.The sensors, mounted on the subject vehicle, detect a second vehicleproximate to the subject vehicle, and acquire sensor data related to thesecond vehicle. The various processor components are programmed toanalyze the sensor data, thereby determining the position or velocity oracceleration of the second vehicle; to determine if a collision isimminent between the subject and second vehicles by analyzing theposition, velocity, and acceleration data; and to calculate sequences ofpositive accelerations or decelerations or steering actions of thesubject vehicle, so as to avoid the collision or minimize its harm.Further processor components are programmed to determine whether animminent collision, according to the sequences, is avoidable orunavoidable; and to select an avoidance sequence (if avoidable) or aharm-minimization sequence (if unavoidable) according to the avoidancedetermination. Finally, a processor component is programmed to implementthe selected sequence, for example by sending control signals to causethe subject vehicle to accelerate or decelerate or steer according tothat sequence.

A system according to present principles may alternatively comprisesensors, to acquire sensor data related to a second vehicle proximate tothe subject vehicle, and one or more processors programmed to performmethod steps which include: analyzing the sensor data to determine theposition, velocity, or acceleration of the second vehicle; determiningwhether a collision is imminent; and calculating one or more sequencesof accelerations or decelerations or steering actions to avoid thecollision or to minimize the harm of the collision. The method furtherincludes determining whether the collision is avoidable, according toeach of the sequences; and then selecting an avoidance sequence if thecollision is avoidable and selecting a harm-minimizing sequence ifotherwise; and then implementing that sequence by generating controlsignals which control the subject vehicle's acceleration, deceleration,and steering.

As yet another alternative, a system according to present principles maycomprise sensors acquiring sensor data about the second vehicle, and oneor more processors programmed to perform a method which includesanalyzing the sensor data and determining the position or velocity oracceleration of the second vehicle. The method additionally includescalculating a plurality of sequences of acceleration, deceleration, andsteering of the subject vehicle, if the sensor data indicates that acollision is imminent. Then, if the collision is avoidable, one of thesequences that avoids the collision is implemented, and if the collisionis unavoidable, one of the sequences that minimizes the harm of thecollision is implemented. As mentioned, implementation includes sendingcontrol signals to the means for accelerating, decelerating, andsteering the subject vehicle.

A further alternative embodiment of a system according to presentprinciples again comprises sensors to acquire sensor data regarding thesecond vehicle, and processors programmed to analyze the sensor data,thereby determining the position, velocity, or acceleration of thesecond vehicle, and thereby determining if the sensor data indicatesthat a collision is imminent. The processors are further programmed todetermine, when a collision is imminent, whether the collision isavoidable in view of the maximum operating parameters of the subjectvehicle. The maximum operating parameters comprise data stored on thesubject vehicle and indicating the maximum acceleration, maximumdeceleration, or maximum steering that the subject vehicle is capableof. Then, the processors calculate a collision avoidance strategy or aharm minimization strategy, depending on the avoidability of thecollision according to sequences that comply with the maximum operatingparameters; and that strategy is then implemented.

As used herein, two vehicles are projected to “coincide” if theprojected positions of the two vehicles are substantially the same, orwithin a particular radius, at a particular future time. The vehiclesizes are accounted for in this calculation, so that if any portion ofthe subject vehicle overlaps with any portion of the second vehicle (orcomes within the particular radius thereof), at a particular projectedtime, a collision is projected to occur.

In real time, while a sequence is being implemented, each action of theselected sequence may be revised or adjusted or “fine-tuned” in realtime on the basis of further sensor data, to account for the actualmotions of the vehicles which may differ from the initially projectedmotions. For example, an acceleration may be adjusted slightly so thatthe point of contact will miss the passenger compartment of the struckvehicle, thereby saving lives. During the collision and after thecollision, the system continues to analyze further sensor data, therebyrecognizing any unforeseen threats. The system updates the sequenceaccording to changing conditions, while continuing with the interventionuntil all threats have passed. Thus the system does everything possible,and continues to do everything possible throughout the intervention, tosave the people involved.

The future position projections are uncertain because they are based onsensor data which is itself uncertain. The system may account foruncertainties by assuming a nominal uncertainty value for the speed anddirection of each vehicle. In that case the calculations would determinethat the collision is imminent if the subject and second vehicles willcollide, or pass within a predetermined radius of each other, assumingthat the velocities and directions of the subject and second vehicleswill remain unchanged within a nominal uncertainty value. For example,the collision would occur if the subject and second vehicles continuetraveling at their current speeds and directions, to within a nominaluncertainty in velocity and a nominal uncertainty in direction. (To erron the side of safety, a near-miss counts as a projected collision forthe purposes of determining imminency.) More specifically, the vehiclesare projected to collide if their speeds remain constant within plus orminus 5% of their current speed values for example, and their directionsremain unchanged within plus or minus 5% of one radian (whichcorresponds to plus or minus 3 degrees, approximately) of their currentdirections. The nominal 5% error estimates, although cited here asexamples, are believed to be typical of the uncertainties commonlyobtained with sensor systems and analysis methods known in the art. Anadvantage of including the uncertainty estimates in the collisioncalculation is added safety. An event that looks like it will be anear-miss may turn out to be a catastrophic collision, due to theprojection uncertainties. Therefore, for added safety, the system mayinclude nominal velocity and directional uncertainties in the imminencycalculation.

The method may include explicitly determining whether a collision isimminent by projecting the subject vehicle's trajectory forward in timeand comparing it to the second vehicle's trajectory projected forward intime; or the imminency determination may be omitted by, for example,preparing avoidance sequences for every vehicle detected or a subset ofthose detected. Likewise the method may include explicitly determiningwhether a possible collision is avoidable by finding a sequence ofactions that is projected to avoid the collision, or the avoidabilitydetermination may be omitted by implementing the first sequence that isprojected to avoid the collision.

The method may include determining when to abandon the search for acollision-avoidance sequence and begin implementing theharm-minimization sequence. That determination may be as soon as an“unavoidability criterion” is met. The unavoidability criterion may be atime limit, such as when the projected collision time has shrunk to 1second; or it may be numerical such as when 10 avoidance sequences havebeen tested; or it may be conditional such as having explored all of thestandard maneuvers or having varied all the primary variables in thesequence.

As a way to further reduce the response time, the implementation couldbe started with the “best” sequence found so far, without waiting for anunavoidability criterion. Additional sequences would be tested while theimplementation is in progress, and if one of those sequences avoids thecollision, it could be implemented instead. Or if one of the additionalsequences causes less harm, the system could switch to it. The advantageis that the intervention could begin immediately rather than waiting formultiple analyses to complete. Another advantage is that the sequencecould be adjusted or revised when better sequences are discovered, andwould be further adjusted with updated sensor data or to handle anyunforeseen changes in the scenario. Substantially greater demands areplaced on the processor(s) to simultaneously analyze the avoidability ofsequences and calculate the harm they would cause, all whileimplementing one of the sequences; but in an impending collision, timesaving is life saving.

The systems and methods according to present principles may includemeans for adjusting how the automatic intervention is applied and underwhat conditions. The systems and methods may include indirect mitigationsteps to signal the other drivers, secure the vehicle post-collision,facilitate passenger egress, send help-request messages, and othersteps. The systems and methods may include means for recording andsaving data related to the traffic, the vehicle, the collision, and theautomatic intervention applied. The systems and methods can also provideemergency intervention in highway hazards other than vehicle-vehiclecollisions, such as a solo spinout or debris in the road.

As used herein, “analyzing” typically involves calculating with softwareand a processor, such as a digital electronic computing means.“Estimating” includes calculating or analyzing based on uncertain orincomplete data, thereby obtaining an uncertain but workable value. A“collision” is any contact between the subject vehicle and anothervehicle or object. In a “projected collision”, the subject vehicle isprojected to contact the second vehicle, or alternatively to come withina predetermined radius of the second vehicle. Thus a projected near-missmay be treated as a collision for present purposes, since all suchprojections include some uncertainty. A possible future collisionbecomes “imminent” when the likelihood of the collision rises above apredetermined value, assuming that no corrective action is taken,wherein the likelihood of a collision is calculated by projecting futurepositions of the subject and second vehicles from their currentpositions, velocities, and accelerations, and in some implementationsproviding such in terms of one or more distributions, recognizing thatthe same may be subject to small variations in short timescales, andlarge variations over greater timescales. Alternatively, a collision maybecome imminent if the calculated separation distance between futurepositions of the subject vehicle and the second vehicle is less than apredetermined distance limit, and that separation will occur in a timeless than a predetermined time limit. Preferably the distance limit islarge enough to ensure that collisions are recognized, but not so largethat false alarms frequently occur. Typically the distance limit is inthe range of 0.1 to 1 meter. The distance limit may be adjustedaccording to the velocities and other parameters. Likewise thepredetermined time limit is preferably short enough to avoid falsealarms on remote and improbable hazards, but long enough to allow thesystem to perform the intervention. Typically the predetermined timelimit is within a range of 1 to 10 seconds, but may be adjustedaccording to current parameters. For example, if a second vehicle is faraway, such as 1000 meters away, the two vehicles could collide if bothvehicles remain exactly on their current trajectories for another 3minutes. Clearly, there is plenty of time for either driver to avoid thecollision, so the system would not flag the potential collision asimminent. If, on the other hand, the second vehicle is only 20 metersaway and the calculated collision time is 3 seconds, then the systemwould immediately recognize the collision as imminent and would initiateevasive action.

A collision is “avoidable” if it can be prevented by accelerating ordecelerating or steering the subject vehicle. The collision is“unavoidable” if it cannot be avoided by any combination of acceleratingand decelerating and steering the subject vehicle. The sequence “avoids”the collision if the subject vehicle is projected to not collide withthe second vehicle when the subject vehicle is accelerated according tothe sequence. If the collision is projected to occur even when thesubject vehicle is driven according to the sequence, then the sequencefails to avoid the collision. A collision which is initially avoidablemay become unavoidable as the scenario unfolds, or vice versa, due toactions of the other drivers, or to other unpredictable factors.Therefore the system continually monitors the sensor data andcontinually updates the traffic analysis and continually re-evaluatesthe avoidability of the collision, adjusting the accelerations anddecelerations and steering actions accordingly.

As is well known in physics, the terms “acceleration” and “accelerating”include any change in velocity, including positive, negative, andlateral changes. Although in common usage, people often treat“acceleration” as speeding up, the technically proper meaning includesall velocity changes in any possible direction. Therefore,“acceleration” as used herein includes “positive acceleration” orspeeding up in which the forward speed of the subject vehicle isincreased, “negative acceleration” or “deceleration” in which theforward speed of the subject vehicle is reduced, and “lateralacceleration” or “steering” in which the direction of the subjectvehicle's motion is changed. In practice, positive acceleration iscaused by depressing the accelerator pedal, negative acceleration ordeceleration is caused by depressing the brake pedal, and lateralacceleration or steering is caused by turning the steering wheel. Thusthe general term “acceleration” includes speeding up, slowing down, andchanging the direction of the subject vehicle's motion.

The “subject vehicle” is a particular vehicle in which the system isinstalled. As used here, the vehicle in front of it is the “leadingvehicle”, and the vehicle behind it is the “following vehicle”. Avehicle encroaching upon the subject vehicle from the side is the“encroaching vehicle”. Any vehicle in the lane on the opposite side ofthe subject vehicle from the encroaching vehicle is the “oppositevehicle”. A vehicle in the lane to the right of the subject vehicle isthe “right-side” vehicle, and similarly for the left lane. The driversof the respective vehicles are referred to in the same way, and eachlane is referred to in the same way. Each vehicle may be an automobile,a truck, a bus, a motorcycle, or any other motorized conveyance that maytravel on a road or highway.

A “strategy” is a plan comprising a sequence of actions in a particularorder, thereby to accomplish a specific purpose, for example to avoid acollision or to minimize its harm. A “sequence” or “sequence of actions”or “set of sequential actions” comprises one or more acceleration ordeceleration or steering actions in a particular order. The sequence mayfurther include a specification of the magnitude of each action in thesequence, as well as its duration and timing. Usually the sequence ofactions includes thresholds (such as “accelerate until matching theleading vehicle”) and contingencies (such as “illuminate brake lights ifthe leading vehicle slows down”). The sequence may include branches(such as “if the following vehicle continues to accelerate, switch tothe harm-minimization strategy”). The sequence of actions may beimplemented by sending control signals to control the subject vehiclethrottle, brakes, and steering, and optionally the lights and othercontrols. Preferably the control signals are adjusted by feedback, inwhich sensors measure the position, velocity, or acceleration of thesubject vehicle, and any deviation from the expected trajectory wouldcause the control signals to be revised. “Direct mitigation” comprisescontrolling the throttle, brakes, and steering of the subject vehicleaccording to the selected sequence, with or without feedback from theinternal sensor data. “Indirect mitigation” comprises controllinganything else, such as turning off the fuel pump, rolling down thewindows, flashing the brake lights, sounding the horn, alerting thedriver or occupants, sending a help-request message, and the like.

The “harm” of a collision includes all negative consequences of thecollision, and may be analyzed or quantified according to a valuationscheme. Such a scheme would place high value on saving lives, a lowerbut still high value on preventing injuries, and also a value on anyphysical damage caused by the collision. Then the overall harm of theexpected collision may be quantified by multiplying each type of harm,times its valuation, and then adding together all the types of harmsexpected for the collision. The various types of harm could also bemultiplied by probability factors to account for uncertainties. Thus ahigh-speed collision would include an entry for possible loss of lives,whereas a low-speed collision would include mainly property damagecosts. As used herein, the “minimum-harm sequence” is a particularsequence of actions that is expected to produce less harm than any ofthe other sequences so far analyzed.

The system according to present principles includes sensor means,computing means, direct mitigation means, and indirect mitigation means.Direct mitigation means comprise means for positively accelerating,decelerating, and steering the subject vehicle. Indirect mitigationmeans include means for controlling the lights, horn, windows, doorlocks, and other parts of the subject vehicle. Likewise, the inventivemethod includes steps for sensing, computing, implementing directmitigation, and implementing indirect mitigation.

The sensor means comprises internal sensors and external sensors. Theinternal sensors comprise any measurement devices mounted on the subjectvehicle that measure a parameter of the subject vehicle such as itsposition, velocity, direction, acceleration, the status of the brakes orsteering wheel, or any performance problems such as a loss of traction.Accelerometers are an example, and such may include 1-axis or 2-axis or3-axis such accelerometers. The internal sensors produce sensor datarelated to those measurements and convey the sensor data to thecomputing means. The external sensors comprise any measurement devicesmounted on the subject vehicle that measure a parameter or quantity orimage of another vehicle proximate to the subject vehicle, and producesensor data related to that measurement.

The computing means comprises a computing environment and non-transitorycomputer-readable media. The computing environment comprises a computer,CPU, GPU, microprocessor, microcontroller, digital signal processor,ASIC, or other digital electronic device capable of analyzing data fromsensors and preparing a collision-avoidance or a harm-minimizationsequence of actions, which includes controlling the acceleration ordeceleration or steering of the subject vehicle according to thesequence. The computing means may comprise one or more processors, eachprocessor being configured to perform one or more of the computingtasks, including such tasks as analyzing sensor data, calculating futurepositions of vehicles, estimating harm associated with a possiblecollision, and transmitting control signals. The non-transitorycomputer-readable media comprise any digital data storage media, capableof storing instructions such as software instructions that, whenexecuted, cause the computing environment to perform a method formitigating vehicle collisions. Examples of such media include rotatingmedia such as disk drives and CD's, solid-state drives, permanentlyconfigured ROM, detachable memories such as “jump” drives and micro-SDmemories, and the like, in contrast to transitory media such as acomputer's working memory (RAM, DRAM, cache RAM, buffers, and the like).

The means for positive acceleration, deceleration, and steering includeany electronic or mechanical or hydraulic interconnects operationallyconnected to the brakes or engine or steerable wheels of the subjectvehicle. The braking or deceleration means may include standard uniformbraking on all of the wheels together, or it may include differentialbraking on each of the wheels of the subject vehicle. Differentialbraking, while not essential for implementation of the presentprinciples, would provide maximum agility in an emergency. The systemsand methods according to present principles preferably provide a rapidand finely adjustable response, so that the acceleration or decelerationmay be precisely timed and adjusted by the computing means. Precision iscrucial; there is a big difference between stopping 10 centimetersbefore reaching another car's bumper, and stopping 10 centimeters afterit.

The computing means may include a processor configured or programmed tocalculate vehicle trajectories over time using a predictive kineticmodel. The kinetic model may comprise software and processor meansconfigured to calculate the positions and velocities and accelerationsof vehicles proximate to the subject vehicle in real time, and to“project” or calculate future positions of those vehicles. The processorcomponent also calculates future positions of the subject vehicle basedon data from the internal sensors such as the velocity and accelerationof the subject vehicle. The system includes a processor componentconfigured to detect imminent collisions, for example by calculatingfuture positions of vehicles, thereby detecting that one of the vehicleswill contact the subject vehicle, or will come within a predetermineddistance limit, if no corrective action is taken. For example, theprocessor component may project the position of a vehicle forward intime over short time intervals by integrating the acceleration of thevehicle with respect to time, and adding the current velocity of thevehicle, thereby obtaining future velocity values for the vehicle. Overlonger time intervals, the acceleration may be assumed to subside as thevehicle reaches a velocity that the driver intends, in which case adeclining acceleration would be integrated to obtain the futurevelocities. The processor component may further integrate the velocityof the vehicle with respect to time, and add the current position of thevehicle, thereby obtaining future positions of the vehicle. Thesepositions comprise the calculated “trajectory” of the vehicle.

The processor component may detect possible collisions between thesubject vehicle and a second vehicle by comparing the subject vehicle'sfuture positions and a second vehicle's future positions at particulartimes. If the future position of the subject vehicle and the futureposition of the second vehicle coincide, or come within a predetermineddistance limit of each other, a collision is possible. The processorcomponent may alternatively be configured to calculate the distancebetween the subject vehicle and the second vehicle, and the relativevelocity between the two vehicles, and the relative acceleration betweenthe two vehicles, and then to calculate the separation distance betweenthe vehicles at future times by integrating the relative accelerationand relative velocity as described above. As is well known in physics,all motion is relative; hence it is immaterial whether the positions ofthe two vehicles are compared at future times, or the distance betweenthem is projected forward in time. Future collisions would be detectedequally by either calculation method.

The processor component calculating the kinetic model also calculates acollision time which is an estimate of how much time remains before thevehicles will collide. If the collision time is less than apredetermined threshold, the processor indicates that the collision isimminent.

The computing means may further be configured to use artificialintelligence and learning algorithms, thereby to predict futurepositions of the subject vehicle and other vehicles under a wider rangeof circumstances. The computing means so configured may also improve thecalculations that determine if a collision is imminent or unavoidable,and may also enable better avoidance strategies to be devised. Forexample, if a second vehicle in an adjacent lane is drifting slowlytoward the subject vehicle but has not yet approached the lane markerline, then the model may conclude that the drifting vehicle is not yet athreat since the second vehicle's driver may easily correct thesituation. Possibly the system may sound the horn to alert theapproaching driver. If the second vehicle then touches the lane line,the model may increase the threat level and determine that a sidecollision is imminent, and may responsively initiate evasive action.

As another example of the processor analyzing traffic using artificialintelligence, the external sensors may determine from the lane lines, orother indicators of the roadway ahead, that the roadway is about tocurve. When the roadway curves, drivers begin to turn into the curve atthe start of the curve, but different drivers may perceive the start ofthe curve slightly differently. Therefore each vehicle may driftlaterally to a limited extent while entering or exiting a curve, andeach driver then compensates by steering. The processor is preferablyconfigured to anticipate that the vehicles will follow the curvegenerally but not perfectly, and will anticipate a certain amount oflateral motion. If a second vehicle, positioned in the lane beside thesubject vehicle, drifts laterally to a minor degree at the beginning ofa curve, the processor would not count this as an imminent collision.But if the second vehicle crosses the lane line or otherwise encroachesupon the subject vehicle, then the kinetic model would quickly recognizethat evasive action is needed.

The processor may be further configured to monitor the rate of change ofacceleration of the subject vehicle, or of the second vehicle, or both.The rate of change of acceleration is a valuable indicator of thedriver's intent. When the rate of change of acceleration is low, thefuture velocity and positions of a vehicle may be calculatedstraightforwardly by assuming the acceleration will subside when adesired velocity is obtained. If the acceleration suddenly changes,however, this is usually an indication that the driver has decided to dosomething different such as changing lanes or braking, in which case thefuture positions of the vehicle are difficult to calculate since thereis no way to know how the driver is going to change the acceleration,among other unknowns. Nevertheless, if the processor includes artificialintelligence, it may be able to correlate the change in acceleration toa particular intent of the driver. Such a deduction may enable futureprojections of the vehicle's position and velocity to be calculated withsome accuracy even as the acceleration is variable. For example, if theleading vehicle happens to drift right to a lane line and then suddenlyaccelerates left toward the center of the lane, the model may interpretthat change as indicating that the leading driver suddenly realized hewas over the line and took corrective action, rather than assuming thatthe leading vehicle was about to change to the left lane or somethingelse. Furthermore, the processor may conclude that the leading driver isdistracted, and in response may open a little extra space betweenvehicles, just as a human would.

The processor, configured with artificial intelligence, may enable thekinetic model to identify potential collisions and determine that theyare imminent or unavoidable or harmless. The artificial intelligencesystem performs faster and better than any human could because thesystem receives data from multiple sensors in real time, which a humancould not possibly integrate while driving. In addition, the systemincludes advanced multi-core computing power capable of analyzingmultiple scenarios simultaneously, all at electronic speeds. Inaddition, the kinetic model may be updated or revised, for example bywireless updating, on a periodic basis, thereby ensuring that the mostadvanced traffic analysis procedures are employed. Furthermore, themodel may include a learning capability based on observation. Forexample the system could note instances in which one of the trafficvehicles did not move as predicted by the model, and the processor couldthen adjust certain model parameters accordingly to provide betterpredictions in the future. In addition, the processor configured tolearn from experience could monitor the subject driver's habits and thentake them into account. Thus if a particular driver likes to drive fastand furious, the kinetic model may account for this by lowering thethreshold for declaring a possible collision as imminent, or otherparameter adjustments, thereby providing optimal safety despite theparticular driver's bad habits.

In analyzing traffic, the processor is preferably configured tocalculate the entire evolving traffic scenario rather than simplyextrapolating current velocities in a linear fashion. For example, theremay be enough room at the present moment for the subject vehicle to passa bus, but looking ahead there is a narrowing of the lane or there isanother car preparing to change lanes, and consequently the safetywindow will close before the pass can be completed. The processor ispreferably able to carry forward the entire maneuver all the way tocompletion, thereby discovering that it will become unsafe halfwaythrough. In a similar way, the processor may be programmed to keep anescape route open at all times. Collisions are rare, and they almostalways start out benign, but then evolve into imminent threats, and theninto unavoidable threats, as the scenario unfolds.

The system further includes a processor configured to analyze a largenumber of possible sequences of actions, each sequence comprisingperiods of positive acceleration and deceleration and steering of thesubject vehicle in a particular order. Preferably each sequence furtherspecifies the intensity, duration, and timing of each action. Thesequences may also specify conditional steps or branches wherebyalternative actions may be carried out according to an observed event orparameter. The processor is configured to analyze how the imminentcollision would proceed if positive accelerations and decelerations andsteering were applied to the subject vehicle according to one of thesequences, and thus to determine if any of the sequences would cause thesubject vehicle to avoid the collision. These calculations may beperformed using the kinetic model, or they may use a separate processorand software.

Preferably the processor includes certain capability-data about thesubject vehicle including the maximum positive acceleration, the maximumdeceleration, and the maximum rate of steering that the subject vehicleis capable of, and preferably each action in the sequence would be nogreater than those maximum values. If the analysis indicates that thesubject vehicle would avoid the collision if driven according to any oneof the sequences, then the collision is avoidable. If none of thesequences enables the subject vehicle to avoid the collision, thecollision is unavoidable. For example, the capability-data may beprovided by the vehicle manufacturer, stored on non-transient memorysuch as a solid-state disk, and transferred to the working memory or RAMas soon as the vehicle's engine is started. Thus the capability-datawill be available instantly when needed as the sequences are developed.

The processor may be further configured to first consider “often used”evasive maneuvers, depending on the type of hazard. Such maneuvers maybe stored as a sequence of accelerations in non-transient memory untilneeded, and may be periodically updated using, for example, wirelesstechnology to provide the most successful and well-tested evasivemaneuvers known. Thus the processor would select one of the standardmaneuvers according to the type of threat detected, and would use thatmaneuver as a basis for planning the intervention, and would adjustparameters in the standard maneuver by, for example, varying the timingor amplitude of the various accelerations in the standard maneuver toavoid the particular collision at hand. The advantage of firstconsidering the previously-successful strategies is that they may saveprecious time in deciding on a course of action. Also these well-testedmaneuvers may enhance the probability of avoiding the collision, asopposed to starting over by exploring a wide range of possiblemitigation steps for each new threat.

A processor is configured to select, if the collision is avoidable, thebest sequence of actions according to a criterion, such as applying theleast amount of acceleration necessary to avoid the collision. Aprocessor is configured to prepare a collision-avoidance sequence. Thecollision-avoidance sequence includes control signals that, when sent tothe acceleration means (such as the throttle, brakes, and steering), aresufficient to cause the subject vehicle to change velocity according tothe selected sequence of actions. The collision-avoidance sequence mayalso include indirect mitigation steps such as flashing the brake lightsstrategically. A processor is further configured to implement thesequence by sending those control signals to the acceleration,deceleration, and steering means. The processor is further configured toadjust the control signals according to the actual position, velocity,and acceleration of the subject vehicle, as determined by internalsensors, thereby causing the subject vehicle to more closely follow theselected trajectory. A processor is configured to continue monitoringthe subject vehicle and the other vehicles, updating the strategy, andadapting as needed in response to any unexpected changes. As mentioned,all of the listed processors or processor components may comprise asingle multi-purpose computing means, which may be embodied as a singleelectronic computing circuit, or they may comprise an array of separatecomputing means with data interconnects.

A processor is configured to prepare, if the collision is unavoidable, aharm-minimization strategy comprising a sequence of actions to controlthe collision process so as to minimize the overall harm caused by thecollision. In many if not most traffic collisions, the bestharm-minimization sequence is quite different from a collision-avoidancesequence. First of all, none of the collision-avoidance sequences willwork since the collision is known to be unavoidable. Secondly, the goalsof collision-avoidance are different from harm-minimization. The goal ofthe harm-minimization strategy is to manage the inevitable collision inreal time, so that ideally everyone involved can ride through thecollision or collisions and then walk away afterwards, even if the carsare destroyed. For example, a collision may be softened by deliberatelycausing two glancing collisions rather than one penetrating strike. Inan imminent collision from the rear, the peak acceleration can belowered by positioning the subject vehicle midway between the leadingand following vehicles as they come together. A freeway spinout from aside-encroachment collision can be avoided by steering slightly into theencroaching vehicle at the moment of impact, rather than away from it asmost drivers would do. In heavy traffic, a direct front-end collisioncan be turned into a series of non-lethal fender-benders by aiming thesubject vehicle between lanes, thereby grinding between two rows ofcars. In each case when a collision is unavoidable, theharm-minimization strategy promotes one or more controlled collisions,rather than the ballistic smashup that would occur without intervention,thereby minimizing the net harm when it is all over.

A processor is configured to prepare the harm-minimization strategy incooperation with the kinetic model and the dynamic collision model. Thedynamic collision model takes as input the positions and velocities ofthe colliding vehicles at the time of contact, as predicted by thekinetic model. The dynamic collision model then analyzes the expectedcollision, and calculates the physical distortions that will be imposedon each vehicle, and calculates the peak accelerations expected to beexperienced by the occupants. The dynamic model may also predict whetherthe drivers will likely maintain control of their vehicles after acollision, and whether a vehicle will go into a spin, and whether theairbags will deploy, depending on where and how hard the vehicle ispredicted to be hit.

For each sequence of actions considered, a processor is configured tocalculate the expected harm resulting from the collision as it wouldoccur if those actions were implemented. The processor may use thecollision predictions of the dynamic collision model as a startingpoint. In particular, the processor calculates, or at least estimates byanalysis, how many fatalities, how many injuries, and how much propertydamage would likely result from a collision according to each of thesequences. The processor may multiply each estimate by a coefficient,such as a fatality coefficient and an injury coefficient and a propertydamage coefficient. The processor may further multiply each estimate bya probability associated with the fatality, injury, and damageestimates. The processor may further estimate multiple levels of injury,for example treating major crippling injuries with more priority thanminor bruises. Then the processor calculates the estimated overall harmof the collision by adding up the various products, each product beingthe predicted quantity of each type of harm, multiplied by itsprobability, times the associated coefficient. It should be understoodthat quantification of harm is a difficult problem, and the examplecalculations provided herein are minimal. Developers may devise otherharm analysis schemes, with more detailed parsing of harm types and moredetailed resolution of uncertainties, without departing from the scopeof the invention.

After analyzing the various predicted harm values resulting from a largenumber of sequences, the processor is configured to select theparticular sequence that results in the lowest expected harm.Alternatively, the best sequence may be selected as soon as a time limitis reached such as when the time to contact has shrunk to two seconds,or after a harm threshold is reached such as when a sequence produces nodeaths and no serious injuries, or by another criterion, e.g., when aharm threshold is calculated for a sequence of actions that is less thanthe amount of harm calculated for the present situation in the absenceof intervention. The harm-minimization sequence determines the controlsignals that cause the acceleration means, deceleration means, andsteering means of the subject vehicle to produce the positiveaccelerations and decelerations and steering as specified, and mayinclude indirect mitigation steps such as turning off the fuel pump andalerting the occupants that a collision is about to occur and sending ahelp request message. A processor is further configured to implement thestrategy by sending the control signals to the throttle and brakes andsteering mechanism accordingly, as well as triggering the indirectmitigation steps.

The processor is further configured to continually monitor the sensordata, and continually update the kinetic model, and continually reassessthe imminency and avoidability of the collision, and continually adaptthe sequence as the scenario unfolds. By tracking the positions andvelocities of the various vehicles, including the subject vehicle, theprocessor can reassess the threat level periodically or wheneverconditions change significantly. If the intervention is successful, thethreat level may be reduced from “imminent” to “benign”, in which casethe intervention may cease (although the monitoring of the variousvehicles and scanning for emerging hazards will continue as usual). Onthe other hand if the situation deteriorates and the threat level israised to “unavoidable”, the processor is configured to recognize thisby updating the kinetic model with updated vehicle data, and toimplement the harm-minimization strategy.

The method comprises sensing other vehicles proximate to the subjectvehicle, using the external sensors; analyzing data from the externaland internal sensors to project the various vehicle positions forward intime; detecting an imminent collision between the subject vehicle and asecond vehicle; further analyzing to determine that the collision isavoidable if it would be avoided by positively or negatively orlaterally accelerating the subject vehicle according to a particularsequence, and that the collision is unavoidable otherwise. The methodfurther includes preparing a collision-avoidance strategy comprisingaccelerating or decelerating or steering the subject vehicle to avoidthe collision if it is avoidable, or preparing a harm-minimizationstrategy comprising accelerating or decelerating or steering the subjectvehicle to minimize the harm caused by the collision if it isunavoidable; and then implementing the selected strategy by sendingcontrol signals to cause the subject vehicle to positively accelerate ordecelerate or steer according to the selected strategy. The strategy maycomprise a data block specifying the sequence of actions, and possiblytheir amplitudes and durations, such as applying the brakes for 3seconds at one-half the maximum deceleration limit. The strategy mayinclude conditionals and branches, such as “apply brakes until thesubject vehicle matches the leading vehicle's velocity”, or “increasebraking pressure if the leading vehicle slows down”. Typically the datablock comprises instructions in the working memory of a processor suchas RAM, although it may also be copied to non-transient storage meanssuch as a solid-state drive.

Typically an imminent collision is detected by measuring the positionsand velocities, and preferably the accelerations, of vehicles proximateto the subject vehicle; then calculating their future trajectories; thendetermining if any of the vehicles will contact the subject vehicle, andif so, when. If the collision will occur in a time less than apredetermined time limit, the collision is imminent and furthermitigation steps are then triggered. The time limit may be dependent onthe relative velocity of the vehicles and on other factors, the intentbeing to provide enough time to avoid the collision if possible.Calculating the vehicle trajectories includes projecting the positionsand velocities of the vehicles forward in time. Typically a numericalmodel such as kinetic traffic model is used for this analysis. Theanalysis may further include factors such as the rate of change ofacceleration of the other vehicles, status of their brake lights or turnsignals, and any other factors that may influence the likelihood thatthe vehicle will collide with the subject vehicle.

The imminent collision is then analyzed to determine whether it isavoidable or unavoidable. The analysis proceeds by considering a largenumber of sequences, each sequence including a set of accelerations anddecelerations and steering of the subject vehicle in a particular order.Preferably the magnitudes and durations and timing of these steps arealso specified in the sequence. Each sequence is then analyzed,preferably using the kinetic model, to determine if the collision willstill occur if the subject vehicle's trajectory is changed according tothe sequence. If the collision will be avoided by accelerating anddecelerating and steering the subject vehicle according to at least oneof the sequences, then the collision is avoidable. And if none of thesequences is able to avoid the collision, it is unavoidable. Thecollision-avoidance sequence is then implemented by sending the specificvehicle control signals to cause the throttle, brakes, and steering ofthe subject vehicle to perform the desired actions, and optionallyindirect mitigation steps such as strategically illuminating the brakelights.

The determination that a collision is unavoidable may be prompted by anunavoidability criterion, such as a time limit or a number of sequencestested. The criterion may be that the remaining collision time hasshrunk to a predetermined limit such as 2 seconds without finding asuccessful avoidance sequence. Or the criterion may involve havingtested all of the standard maneuvers, or having varied all of thesequence parameters without finding a way to avoid the collision. Whenthe unavoidability criterion is met, the search for a sequence causingthe least harm would be initiated (if it is not already ongoing inparallel with the avoidance search). Preferably, further variations ofthe collision-avoidance sequences would continue to be explored as freshsensor data becomes available, even after the collision appears to beunavoidable, since many unknowns influence the trajectories of vehiclesin a hazard situation. Not uncommonly, an unanticipated escape windowmay open briefly before the actual contact, in which case the automaticsystem could accelerate accordingly, guide the subject vehicle past thesecond vehicle, and thereby reduce a direct impact into a grazing swipethat saves lives.

The harm-minimization sequence of actions is typically prepared bycalculating the harm that will be caused by the imminent collision. Therelative velocity of the colliding vehicles is calculated at theprojected time of the collision, preferably using the kinetic model, andincluding all the accelerations specified in each of the sequenceactions. The kinetic model should also indicate where on each vehiclethe contact will occur. Based on those parameters, the dynamic modelanalyzes the collision and calculates the physical distortions of eachvehicle due to the forces of the collision, including frame compression,penetration into the passenger compartment, and the like. Also, the peakacceleration experienced by each vehicle is computed, along with thedurations and directions of the peak accelerations, and possibly therate-of-change of the accelerations as well since this can affectinjuries. If the vehicle weights are known, or can be estimated from thesensor data, or other source, then they can be used in the calculation;otherwise typical vehicle weights can be assumed. Also the number ofoccupants in the subject vehicle can be obtained by seat sensors, andthe number of occupants in the other vehicle may be assumed a standardvalue such as 1.5 persons, unless otherwise known. Then, with thesecollision parameters and assumptions, the number of fatalities andinjuries can be estimated, and the amount of property damage can beestimated. Empirical formulas may be useful in evaluating these numbers.

The harm is then calculated for the analyzed collision. A large numberof such sequences are then considered and the corresponding collisionsare analyzed and the resulting harm values are calculated.Previously-prepared templates, or often-used maneuvers, may be exploredfirst, since these have been tested and shown to be effective in prioremergency scenarios. To save time, the strategies analyzed in the harmanalysis may be the same as those used previously in thecollision-avoidance calculation, since the resulting trajectoryprojections have already been calculated. Or, a new set of accelerationsand trajectories may be considered for the harm minimization step. Ineither case, the amount of harm that would be caused by a collisionaccording to each of the sequences is computed, and the sequence thatwould result in the least amount of harm is selected.

That sequence of actions expected to produce the least harm is thenimplemented by sending control signals to the throttle, brakes, andsteering of the subject vehicle so as to produce the accelerations,decelerations, and steering which are specified in the selectedsequence. The control signals are continually adjusted by feedback fromsensors that detect any deviation of the subject vehicle from theselected strategy. The harm-minimization sequence of actions preferablyalso includes indirect mitigation steps, a post-collision strategy, andother steps as needed to save lives and minimize injuries.

Often the number of fatalities and injuries and amount of damage causedby an imminent collision are incompletely known from the analysis, butcan be estimated with some uncertainty. In that case each of the harmterms can be multiplied by a probability factor that reflects theuncertainty, to further refine the overall harm value. As a furtheroption, multiple injury types may be analyzed in a similar fashion,separately accounting for serious and minor injuries for example.

Selection of which harm-minimization sequence to implement may beprompted by a criterion such as a time limit or a number of sequencesanalyzed. For example, when the time-to-impact has shrunk by one-half,or when all of the standard maneuvers have been evaluated for expectedharm, then it may be time to start implementing the bestharm-minimization sequence discovered so far.

For a faster response, the first harm-minimization sequence that istested may start to be implemented immediately. At the same time,further sequences continue to be tested for expected harm and, as soonas a sequence with a lower estimated harm is found, the better sequencecan then be implemented instead. Usually the better sequence will be avariation of the already-in-progress sequence so that the change fromone to the other can be done smoothly. But even if the switch betweensequences is not smooth, it is still generally better than delaying theevasive action. Preferably the search for even better sequencescontinues up until the moment of contact, always basing the analysis onthe latest actual trajectory data of the vehicles.

For an even faster intervention, the method may include calculating theexpected harm of every collision-avoidance sequence tested, and storingthat harm value along with the sequence data. Then, if all thecollision-avoidance attempts fail, the best harm minimization sequencecan be identified very quickly from the stored values, without having torepeat the kinetic analyses. Preferably the harm calculation would notretard the search for an avoidance sequence, using for example amulti-core processor that can calculate the harm of each projectedcollision while simultaneously analyzing the next collision-avoidancesequence. If the collision turns out to be unavoidable, the time savedin selecting the least-harm sequence may be crucial.

As soon as a collision becomes unavoidable, or more preferably as soonas it becomes imminent, the systems and methods according to presentprinciples may prepare a post-collision strategy or sequence of actions.Then, after the collision is over, the systems and methods according topresent principles may implement the post-collision strategy to avoid asecondary collision and other post-collision hazards. Preferably thesystems and methods update the post-collision strategy based on sensordata acquired during the collision and after the collision.

The post-collision strategy may include checking the status of thesensors and the processors and other parts of the subject vehicle. Thestrategy may include checking for secondary collision threats such asvehicles approaching from the rear, or from any direction, and then mayarrange to avoid them by driving to the side of the road, or by otherevasions. The post-collision strategy may also include checking for afire and providing warnings if detected. A help-request message may besent, or if one has already been sent, then a more detailed follow-upmessage would be sent, specifying the types of injuries likely to haveoccurred in the collision so that responders can be prepared. If thedriver is responsive, the strategy may include connecting the driverwith a first responder directly.

The post-collision strategy may include determining whether the driveris responsive or nonresponsive, for example by monitoring the brakepedal, the accelerator pedal, and the steering wheel, and possibly othercontrols. If the driver uses any of these controls after a collision,the driver is responsive. The automatic system may be configured to haltthe intervention if the driver is responsive, thus deferring to humanintelligence in an unpredictable situation. However if the driver failsto use any of the controls, the driver would be deemed nonresponsive,and the post-collision strategy would be implemented as planned.

The systems and methods according to present principles may includetransmitting, when the collision becomes imminent, a help-requestmessage that includes information on the nature and location of thecollision, and a conditional activation time. Then, a cancellationmessage is transmitted if the collision is avoided, thus relieving firstresponders from unnecessary false alarms.

The strategy may include indirect mitigation steps including turning offthe fuel pump, unlocking the doors to prevent being trapped inside,disabling child-proof lockout features, rolling down the windows topermit escape, detecting a fire, informing the driver and otheroccupants that a collision is imminent, informing the driver that thesystem is taking over control of the vehicle, and sending a help-requestmessage. Indirect mitigation may further include illuminating the brakelights at any time, regardless of whether the brakes are actuallyengaged. For example the brake lights may be lit up upon determiningthat a collision is imminent, thereby giving the following driver alittle extra time to avoid hitting the subject vehicle, or at least tocollide with less velocity. The system may also keep the brake lights oneven after the subject driver has released the brake pedal. For example,it may be advantageous to cause other drivers to think that the subjectvehicle is still slowing down, and therefore to slow down themselves.

The system preferably includes adjustment means to allow the driver todetermine when and how the automatic system intervenes. Some driverswould prefer that the system intervenes only in an emergency, whileother drivers would appreciate automatic assistance for minor operationssuch as maintaining a distance to the vehicle in front, or stayingcentered in lane. When a collision becomes imminent, some drivers wantthe automatic system to override the driver's actions completely, whileothers want to maintain some control. Drivers may also want theautomatic system to wait for a brief interval before intervening, toallow the driver to handle the situation first.

In addition, the system may include means for the driver to override theintervention entirely. For example a dash-mounted disabling button maybe pressed by the driver to cease all automatic emergency controlsignals and allow the driver to maintain direct control of the vehicle.Alternatively, a particular signal such as two quick taps of the brakepedal may cause the emergency system to relinquish control. The manualoverride may be temporary, expiring after a brief time such as a fewseconds or a minute; or the automatic system may remain disabled untilthe driver takes some other action such as pressing a button. Preferablythe system would revert to the enabled state each time the vehicle isstarted up.

The system may include means to ensure that the driver is not undulydepending on automatic interventions, for example a driver who iswatching a video while the vehicle drives itself. Such over-dependenceon the system for continuous hazard avoidance would be dangerous. Todetect such an over-dependence situation, the system may require thatthe driver take some action periodically, such as turning the steeringwheel or adjusting the throttle at least once every 10 or 20 seconds. Ifthe driver fails to do so, the system may issue a sonic or visual alert,giving the driver another period, perhaps 2 to 5 seconds, to take somedetectable action. If the driver again fails to do so, the system maydeduce that the driver is incapacitated or at least distracted, and maypull to the side of the road, send a help message, or other action.

In addition, the system may detect when the driver is driving sodangerously that the emergency intervention is invoked frequently. Forexample a “dare-devil” driver may deliberately drive recklessly, knowingthat the system will keep him safe by intervening at the last second. Inthat case the system may send a message to the local police, or maybegin refusing to exceed the current speed limit for some period oftime, or may pull to the side of the road until the engine is stoppedand re-started, or other action.

The system includes means for recording data in non-transient media forfuture reference, including detailed data from the internal sensors,summary data from the external sensors, and a complete record of theinterventions implemented by the system. The recorded data should besufficient to allow the causes of the collision to be reliablydetermined, even if there are no survivors. The recorded data are alsointended to enable any errors in the automatic responses to be uncoveredand repaired, so that the reliability of the system may be improvedsteadily with experience. The recorded data may also be useful in legalcases both criminal and civil. Insurance companies may use the data togauge a driver's level of risk and adjust premiums accordingly. Parentsof young drivers may review the recorded data to ensure that unnecessaryrisks are not being taken. The data may enhance the quality of nationalhighway safety by revealing unforeseen risks.

In addition to mitigating collisions between vehicles, the systems andmethods according to present principles may also provide automaticassistance to avoid or reduce the harm of other highway hazards. In thecase of potential collisions with objects other than vehicles—such asdebris, pedestrians, animals, and fallen rocks or trees—the system mayin some implementations recognize and avoid them in the same way as itdoes for vehicles. This capability generally requires merely thatnon-vehicle types of objects be added to the recognition templates ofthe image analysis software, a straightforward modification. Inaddition, the systems and methods may provide instantaneous assistancein emergencies other than potential collisions, for example emergenciessuch as a loss-of-control event, a solo spinout, a rollover, exiting thepavement, a tire blowout, and any other emergency situation that thesystem can recognize as dangerous on the basis of the internal sensors.Although it is probably not feasible to eliminate every possible hazardthat could occur, nevertheless the majority of highway hazards,including all those listed in this paragraph, can be detected andmitigated effectively using the system hardware and methods asdisclosed, with a few straightforward additions.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a sketch showing sequential positions of three cars in atraffic lane at successive times, according to a prior-art automaticbraking scheme. In this case, due to the limitations of the prior art, acollision occurs needlessly.

FIG. 2 is a sketch showing sequential positions of three cars in atraffic lane at successive times, according to a collision-avoidancestrategy according to an implementation of present principles. Bycontrolling the braking with a sensor-based predictive traffic modelaccording to the present principles, a collision is narrowly avoided.

FIG. 3 is a sketch showing sequential positions of three cars in atraffic lane at successive times, guided by a minimum-harm strategyaccording to present principles. By adjusting the acceleration ordeceleration of the subject car to remain centered between the othercars, the collision energy and acceleration are minimized.

FIG. 4 is a sketch showing five cars on a multilane highway in which aside-encroachment collision is narrowly avoided by a system according tothe present principles.

FIG. 5A is a sketch showing five cars on a multilane highway in whichthe opposite lane is blocked. In this case a prior-art system is in use,which unfortunately fails to avoid the collision. FIG. 5B shows how aserious collision could occur with the prior-art system.

FIG. 6A is a sketch showing the same traffic arrangement as FIG. 5A, butnow using a system according to present principles to devise aneffective mitigation strategy. FIG. 6B shows the resulting collision,which thankfully is a relatively mild fender-bender.

FIG. 7 is a sketch showing successive positions of a vehicle,demonstrating how a system according to the present principles avoids ahighway hazard other than a vehicle collision, in this case by avoidinga pedestrian.

FIG. 8 is a flowchart showing how a possible collision with a secondvehicle can be avoided or, if unavoidable, how the minimum-harm actionscan be implemented.

FIG. 9 is a flowchart showing the steps of a method according to thepresent principles including a step of explicit determination that acollision is imminent or avoidable or unavoidable.

FIG. 10 is a flowchart showing the steps of a method according to thepresent principles in which the collision avoidance and harmminimization proceed concurrently.

FIG. 11 a flowchart showing the steps of a method according to thepresent principles including calculation steps, post-collisionintervention, and indirect mitigation steps.

FIG. 12 is a schematic of a system according to the present principleswherein the computing means is a central processor which processes allthe sensor data, performs all the analyses, and directly generates thevehicle control signals.

FIG. 13 is a schematic of a system according to the present principleswherein distributed separate processors perform image analysis,calculations, strategy implementation, and other tasks.

FIG. 14 is a flowchart showing the steps of a post-collision strategyaccording to present principles,

FIG. 15 is a schematic of an adjustment means according to the presentprinciples with three operational modes.

FIG. 16 is a table showing the steps of a strategy according to thepresent principles to avoid a collision by changing lanes.

FIG. 17 is a table showing exemplary adjustment means according to thepresent principles and their associated settings.

FIG. 18 is a table showing various degrees of automatic assistance, andthe associated settings and actions, according to the presentprinciples.

FIG. 19 is a schematic showing a system according to the presentprinciples comprising sensors and processor components, with eachprocessor component performing a specific function.

FIG. 20 is a schematic with embedded flowchart, showing how a systemaccording to present principles mitigates collisions by analyzing sensordata, determining if a collision is imminent, determining if it isavoidable, and then implementing an appropriate mitigation sequence.

FIG. 21 is a schematic with embedded flowchart, showing how a systemaccording to present principles determines from sensor data if acollision is imminent, and if so calculates if the collision isavoidable, and then implements an avoidance or harm-minimizationsequence.

FIG. 22 is a schematic with embedded flowchart, showing how a systemaccording to present principles determines from sensor data if acollision is imminent, and if so, calculates whether the collision canbe avoided using up to the maximum acceleration, deceleration, andsteering.

DETAILED DESCRIPTION

A collision mitigation system according to the present principlescomprises sensor means, computing means, acceleration and decelerationmeans, steering means, and optionally indirect mitigation means andadjustment means. The sensor means includes internal sensors andexternal sensors, all mounted on the subject vehicle and all providingsensor data. The computing means may comprise a single computing devicesuch as a multi-core CPU, or it may include any number of separatedigital processors interconnected by data buses. The acceleration meanscomprises the throttle if the subject vehicle has an internal-combustionengine, or whatever regulates the power output if the engine iselectric. The deceleration means comprises the brakes along withelectrical-hydraulic-mechanical controls for the brakes. If the vehiclehas regenerative braking, this system too is included in the brakingmeans. Optionally, and preferably, the deceleration means includesseparate braking controls for each wheel. The steering means comprisesthe steerable wheels, usually the front wheels, of the subject vehicle,along with sufficient mechanical controls to adjust the steerable wheeldirection.

The sensor means includes internal sensors that monitor the velocity andacceleration and deceleration and lateral accelerations of the subjectvehicle, as well as the status of the brakes and steering of the subjectvehicle. Internal sensors may also monitor the number and locations ofoccupants using seat sensors, and may detect fire or other internalhazard conditions. Internal sensors may also monitor the status of theexternal sensors, for example to detect when an external sensor is notoperational.

The sensor means includes external sensors configured to measureinformation about vehicles around the subject vehicle, such as theposition, distance, velocity, and acceleration of the other vehicles,and the yaw or direction of each vehicle, as well as the brake lightsand turn signals of the vehicles. The external sensors may be configuredto measure this information of the encroaching, opposite, leading, andfollowing vehicles or other vehicles in the traffic. The distances andvelocities of the various vehicles may be measured relative to thesubject vehicle, or relative to the ground, or other reference. Eachsensor means may use a different reference. The external sensors mayacquire imaging data to evaluate the types of vehicles involved, therebyenabling an estimation of their stopping capabilities, for exampledifferentiating a dump truck versus a sports car. If one of the vehiclesis a motorcycle, then special consideration for the vulnerability of itsriders may influence the choice of mitigation strategy. In case of apedestrian in the roadway, every possible effort will be expended toavoid hitting the pedestrian. In case of an obstruction that does notinvolve people, such as a rockfall, then the priority will be upon theoccupants of the subject vehicle. The external sensors may acquire dataon the road condition and other information that is not directly relatedto the traffic, such as weather conditions.

The external sensors may include means for detecting other vehiclesproximate to the subject vehicle, and for measuring the distance fromthe subject vehicle to the other vehicles (for example, radar or lidaror sonar or parallax or other distance measuring systems); means formeasuring the velocity of the other vehicles relative to the subjectvehicle or relative to the ground (such as Doppler or timing or othervelocity detecting means); means for measuring the acceleration ordeceleration of the other vehicles; means for detecting the illuminationof brake lights of the leading vehicle or of any other vehicles fartherforward; acoustical sensors to detect horn/siren/alarm/tire-screechsounds; or any other measurement means related to traffic safety.

The external sensors may comprise cameras which may be visible-lightcameras or infrared (IR) cameras or both; active distance-measuringdevices such as radar, lidar, and sonar; GPS; and other sensors. Thesensor means acquires sufficient data to enable the computing means todetermine when a collision is imminent. For example a dual-cameraimaging system comprises a front camera and a rear camera, each of whichis capable of a large field of view, such as at least 270 degrees ofview, and is configured to record or transmit images of the leading andfollowing vehicles as well as vehicles on both sides of the subjectvehicle. The distance to each vehicle may then be calculated bycomparing the observed vehicle image size to a previously calibratedimage size for similar types of vehicles. Or, more preferably, aquad-camera imaging system may comprise four cameras mounted on thecorners of the subject vehicle, with each camera having a wide field ofview to image vehicles in front, behind, and on both sides of thesubject vehicle. The wide field of view is necessary to ensure that atleast two cameras can see each of the other vehicles simultaneously, soas to gauge the distance by parallax or triangulation. Parallax ortriangulation involves comparing two images from two separated points ofview, and thereby measuring the distance to the imaged vehicle based ondifferences between the two images. Each vehicle's velocity relative tothe subject vehicle can then be obtained from the rate of change of thedistance values, and their accelerations can be obtained from the rateof change of the velocities. An advantage of the parallax method is thatit provides accurate distance measurements even when the leading vehicleis not directly in front, for example when going around a curve. Alsothe parallax method does not depend on assumptions about the type andproperties of the other vehicles; it is objective and absolute.

The parallax method performs poorly in fog, falling snow, or heavy rainwith visible cameras, although IR may partially compensate for suchproblems. Therefore the sensor means preferably includes an activedistance measuring sensor such as radar or lidar or sonar. Lidar is theoptical version of radar, in which a brief pulse of IR is directedforward, bounces off one of the vehicles, and is detected by a detectorat the subject vehicle. The distance is then found from the time betweenemission and detection of the pulse. Of course an IR pulse must beeye-safe, and a sonar pulse must be ultrasonic. To avoid detectingscattered signal from other vehicles, the pulse is sufficientlycollimated, and/or the detector is sufficiently collimated, to view onlyone vehicle at a time. Alternatively, the system could scan multiplevehicles simultaneously if the transmitter and the receiver areconfigured as a phased array, in which case the direction and distanceof each vehicle can be deduced by analysis of the reflected waveforms.In the case of lidar, the system can scan multiple vehiclessimultaneously by imaging the reflected signal and analyzing theresulting data to determine both the distance and bearing for eachvehicle relative to the subject vehicle. The relative velocity betweenthe subject vehicle and another vehicle can also be derived from theDoppler shift of the reflected signal, which can be measured byinterferometry for example. Alternatively, a separate low-power CW(continuous-wave) transmitter-receiver may be used to measure theDoppler shift, and thus the relative velocity, of the other vehicle.

The external sensors, by combining data from multiple sensors based ondifferent physical principles, provide greater ability to detectvehicles than prior art systems. For example, a prior art system basedon simple image analysis of optical images could fail to detect anobstruction if it is large and featureless, such as a truck trailercrossing in front of the subject vehicle. The likelihood that the priorart system would miss the hazard is even greater if the trailer ispainted a uniform white, has an albedo similar to a clear sky, andprovides little visual contrast by which the prior art image analysissystem could detect it. On the other hand, a system according thepresent principles would quickly and reliably detect the obstruction, byusing non-optical sensor data such as the IR signature of theobstruction, or the sonar reflected signal, or the short-range radarsignal for example. Alternatively, the obstruction could be detectedusing IR image analysis since objects generally have high infraredcontrast relative to the sky. The need for such a capability isillustrated by a recent horrific accident. A vehicle with a prior artsystem failed to detect a trailer crossing in front of the vehicle, andresulted in the vehicle driving under the trailer without slowing down,killing the driver instantly. A system according to the presentprinciples would have certainly detected the trailer, and would havestopped the subject vehicle in time, and would have prevented theaccident and saved a life.

An embodiment of the computing means comprises one or more computer ormicrocontroller or ASIC or CPU or GPU or other digital electroniccalculating means, configured to take as input the sensor data, andoptionally to determine when a collision is imminent, and optionally todetermine if the collision is avoidable, and to prepare and implement amitigation strategy. The computing means also includes transient memorysuch as RAM or working memory, and non-transient storage media such assolid-state drives. The computing means further includes instructionsstored on the non-transient media specifying how collisions should bemitigated, such as software instructions. The instructions may be copiedto the transient media when the system starts, or at other times, sothat the instructions will be instantly available to the processor whenneeded.

As mentioned, the calculation method must be carried out extremely fastso that the mitigation strategy can be applied in time to do some good.The method must be able to react much faster than any human. Also themethod must be able to track the vehicles while the selected strategy isbeing implemented, and to test if the strategy is working as desired,and to change the strategy if a better option emerges. Prior-artemergency braking systems cannot meet this requirement due to lack ofsuitable processors, lack of a predictive kinetic model, lack of adynamic collision model, lack of means for estimating harm, and otherdeficiencies.

The inventive computing means exploits modern, multi-core processorswith fast memory and fast input bus, to perform the necessary imageanalysis and other tasks needed to select and carry out the mitigationstrategy quickly. Fortunately, such processors are readily available,and at very low cost, as a result of mobile phone development and otherrecent advances. For example, multi-core 64-bit multi-GHz processors areavailable at modest prices which could perform the necessary processingin milliseconds. Also the processor must be able to survive a collision,even a major collision. With proper shock mounting, hardened enclosure,internal battery, and ruggedized connections it would not be difficultto arrange such a survivable processor.

Some of the steps of a method according to present principles areextremely computer-intensive, and also extremely repetitive, such asimage processing and trajectory prediction. Also the data bussesrequired to convey high resolution sensor data to a central locationwould be rather demanding although well within the art. As analternative, the computing means may comprise a plurality of individualprocessors, each connected to a part of the system and configured toprocess just one kind of data. For example, a dedicated image analysisprocessor may be provided for each camera, which would reduce each frameto a few salient data items in real time, and then transmit the highlyreduced data rather than the whole detailed image. Separatepreprogrammed processors could be provided for executing the kineticmodel and the dynamic model, with yet another processor for comparingthe results of those models and selecting the best strategy. Or, threecores of a multicore processor may perform the modeling and selectiontasks in parallel by running three codes in parallel.

A separate implementation processor may prepare and transmit the vehiclecontrol signals to directly control the throttle, brakes, and steeringof the subject vehicle. These signals probably are quite different fromthe other data signals, and in addition will be vehicle-type dependent.Therefore it may be advantageous for the upstream processors to deliverthe desired acceleration-deceleration-steering sequence to theimplementation processor, and let the implementation processor figureout what amplitudes, timing, and durations of control signals will beneeded to cause the vehicle to accelerate, decelerate, and steeraccordingly. Also, a dedicated implementation processor could receiverealtime feedback by monitoring the actual speed, acceleration ordeceleration, and yaw or direction changes of the vehicle, which wouldbe monitored by the internal sensors. Using this realtime feedback,based on the actual motions of the vehicle, the implementation processorcould adjust the control signals to cause the vehicle to more accuratelymatch the selected sequence of actions, and would instantly correct anydeviations that may occur.

Developers may arrange multiple processors in different ways to handlethe various compute tasks, using more or fewer separate processingdevices, without departing from the present principles.

A processor may use a realtime predictive kinetic traffic model whichincludes, at minimum, a catalog of the locations and velocities of allthe other vehicles around the subject vehicle. The kinetic modelcalculates the trajectories of the other vehicles and projects theirtrajectories forward in time. The kinetic model thus detects imminentcollisions, for example by determining that one of the vehicles willcontact the subject vehicle within a predetermined number of seconds ifno corrective action is taken. The kinetic model may includepreprogrammed or default values for parameters such as the minimumbraking distance of vehicles as a function of their actual velocity, thereaction times of normal drivers, and other values related to trafficsafety. The kinetic model may include environmental factors such as thepresence of rain or ice on the roadway, the type of road surface, andthe like. The invention may include sensors to detect those conditions,or may employ an external data source such as the weather service toobtain the environmental data. In addition the kinetic model maydetermine the types of vehicles by image analysis, so as to discriminatefor example between a semi-trailer versus a sports car, and then employseparate values or ranges of values for the presumed deceleration andother values accordingly.

The processor particularly notes any sudden changes in velocity oracceleration of the other vehicles. If configured with artificialintelligence or other advanced analysis software, the processor mayinterpret such changes as an indication of the intent of the otherdrivers, thereby enabling a more accurate projection forward in time. Asan example, if a vehicle in a lane beside the subject vehicle suddenlyturns toward the subject vehicle, the kinetic model may interpret thismotion as the other driver planning to change lanes into the subjectlane. Unless there is plenty of room, the kinetic model would elevatethe threat level even before the other vehicle begins to encroach uponthe subject vehicle's lane. Without such analysis, the threat wouldbecome apparent only after the other vehicle crossed the lane line. Thusthe advantage of artificial intelligence is that it provides earlierwarning of an emerging hazard by correlating observed changes inacceleration with driver intent, thereby resulting in improvedanticipation of subsequent threat situations.

When the collision is unavoidable, a processor analyzes the collisionand calculates the expected harm of the collision. This analysis mayemploy the dynamic collision model which analyzes the energy deliveredto the colliding vehicles, calculates the mechanical effects on thevehicles, their peak acceleration, the peak rate of change ofacceleration, and other parameters related to collision dynamics. Theprocessor may further evaluate the likelihood that each of the vehiclesmay lose control by spinning or skidding for example, or the likelihoodthat one of the drivers may become incapacitated in the collision, whichcould modify the expected outcome further. The processor performs thisanalysis using as input each of a plurality of possible sequences ofactions of the subject vehicle such as braking, accelerating, andsteering. The processor then calculates the expected harm for eachcollision according to each sequence of actions. The processor thenselects the sequence with the least expected harm, prepares acorresponding strategy including control signals and indirect mitigationsteps, and implements the strategy.

The deceleration means include electronic, mechanical, hydraulic, orother linkages to control the brakes of the subject vehicle. Optionally,but preferably, the vehicle includes differential braking means withseparately-controllable linkages to the wheels on the left and right ofthe subject vehicle, or to all four wheels, so that the brakes on eachwheel may be activated individually. A maneuver such as a quick swervecould be performed more rapidly using the differential braking than withsteering alone, because the latency is shorter for braking, and also theachievable forces are generally higher for braking. Additionally, thedifferential braking means and the steering means may be operatedcooperatively to carry out such a maneuver more quickly or with morecontrol or with more safety, for example to prevent a spin-out. Theacceleration means and the differential braking means, activatedsimultaneously on different wheels, would enhance the speed and controland safety of many fast emergency maneuvers.

The system is configured to detect a collision when it occurs, usingmultiple distinct means. In most cases, a collision would be anticipatedbefore it occurs since the system continuously tracks the positions ofother vehicles in real time, and thus would have determined that thecollision is unavoidable before it occurs. If however a collision occursunanticipated, for example from a falling object, the system is quitecapable of detecting that the collision has occurred, for example fromthe internal acceleration sensors. A sudden impulse not related tobraking would indicate that some sort of collision had likely takenplace. Or, a very loud sound consistent with a collision sound may bedetected, or the airbags may have deployed, or a major internal failuresuch as an engine seizure has occurred. In each of these cases, a systemaccording to present principles would detect the collision and beginpost-collision mitigation steps immediately. Notably, the system wouldovercome a serious defect in prior-art systems. Specifically, aparticular prior-art automatic emergency system failed to detect even amassive, vehicle-destroying collision when it occurred; indeed theprior-art system simply continued driving the vehicle as if nothing hadhappened. A system according to present principles would certainly havedetected the collision when it occurred, and would have pulled to theside of the road and radioed for medical assistance. Indeed, a systemaccording to present principles would have detected the hazard inadvance, and would have prevented the collision from occurring in thefirst place.

The system according to present principles may generate a particularsignal such as a collision-detect signal that indicates when a collisionhas occurred. The collision-detect signal may include an electronicsignal such as a voltage or a digital signal that indicates that acollision or suspected collision has occurred. In addition, thecollision-detect signal may include much more information such as a timeand GPS location at which the collision occurred, information about thetype or direction of strike, and other information. The collision-detectsignal may be derived from the external sensors, wherein a collision isdetected when the external sensors indicate that the distance betweenthe subject vehicle and another vehicle shrinks to effectively zero. Thecollision-detect signal may also be derived from the internal sensorssuch as the accelerometers, which would register a sudden largeacceleration not explicable by the action of the accelerator or brakesor steering wheel. The collision-detect signal may include input fromsound sensors, since most collisions are accompanied by a loud suddenimpact sound. The collision-detect signal may be generated as a resultof a massive system failure such as an engine seizure. If the airbagsdeploy, the collision-detect signal would likely follow. However, thecollision-detect signal would preferably not be generated by minorevents such as running over a pothole, notwithstanding that this cangenerate sudden inexplicable accelerations. Most preferably, the systemincorporates all of the above factors into an analysis that evaluates ifa collision has occurred, and then issues the collision-detect signalaccordingly.

While the collision is in progress, the system and method according topresent principles continues to analyze the ongoing dynamics of thecollision using further sensor data, continually explores alternativemitigation strategies, continually updates the selected strategyaccording to the particular way the collision proceeds, and immediatelyrevises the strategy if a better option emerges. This ongoingcycle—reanalysis of the collision and readjustment of thestrategy—continues at full speed as long as new sensor data isavailable, finishing only after the collision is complete and allpost-collision hazards have passed.

After the collision is complete, a processor implements thepost-collision strategy. The post-collision strategy is a sequence ofactions that may include, first, verifying that the processor is stilloperational after the collision, for example with a self-test. If theprocessor fails such a self-test, it may drop to a predetermined holdingstate or shut down altogether. The predetermined holding state mayinclude turning off the ignition and fuel pump, applying the brakes, andunlocking the doors; or the holding state may involve taking no actionat all. If, on the other hand, the processor is still operational afterthe collision, then the next step is to poll the sensors to determinewhich ones are still operational. If the internal sensors are stilloperational, then the condition of the subject vehicle is updatedaccording to the internal sensor data. If the external sensors are stilloperational, the surrounding traffic is monitored, especially checkingfor secondary collision threats. If a secondary collision threat isdetected, a processor prepares a collision-avoidance strategy or aharm-minimization strategy depending on whether the secondary collisionis found to be avoidable or unavoidable, and then implements thestrategy. The strategy may include backing away from the collidedvehicle, or driving to the side of the road, or accelerating to changelanes, or other action to avoid being struck again.

When the processor finds that the threat of a secondary collision haspassed, the processor then applies steps to minimize any potential harmsother than a secondary collision. Such steps may include turning off thefuel pump, unlocking the doors, and possibly rolling down the windows.Steps to alert other drivers of the hazard may also be applied, such asturning on the emergency flashers or sounding the horn in a particularpattern. If the vehicle has a seatbelt-release capability, the seatbeltsare released at that time. If the vehicle has sensors to detect a fireor a gas leak, the vehicle's sound system or any other speaker may beused to alert the occupants, for example saying “Fire! Fire! Get outnow!”

The post-collision steps then include sending a help request message.The help request message preferably is machine-generated so as to notdepend on the driver who may be incapacitated. The help request messagepreferably includes both speech sounds and digital data so that both ahuman operator as well as an automated response system can understandthe message. The digital portion may include more detail such as the GPScoordinates or the speed at the time of collision or injury types ifdeterminable. Preferably the system allows the driver to add spokeninformation to the message, or better yet to speak directly with a firstresponder. Preferably the subject vehicle includes a mapping capabilityto relate the GPS coordinates to street names. The help request messagecould be, for example, “High-speed collision on northbound route 5, onekilometer south of Maple Road. Driver incapacitated. Multiple injuriessuspected. Send ambulance immediately. GPS coordinates and more datafollow:” after which a frequency-encoded machine-readable data blockwould follow. The intent is that either human or machine recipients canrespond to the message.

In one version, a help request message is sent even before the collisionoccurs, along with a contingency and an activation time, such as “Sendemergency help to GPS xxx-yyy unless canceled within 10 seconds.” Then,if the collision is avoided, a cancellation message is sent, preferablywithin the 10-second limit. The emergency response station must be setup to accept and hold such contingent messages until the statedactivation time is reached, to avoid burdening the staff with falsealarms. The help request would then be passed to a human operator onlyafter the activation time, and only if no cancellation message isreceived. While it is desirable to be able to send the help requestmessage before the collision occurs, it is also important not to clog upthe emergency response system with false alarms. Therefore the emergencyresponse station would have to be able to automatically recognize thatthe message is contingent with an activation time, and to store the helprequest message for that time, and only then pass the message to ahuman. This feature may require some upgrading of the emergency responsestation.

Simultaneously, and throughout the post-collision period, the inventionmonitors whether the driver is incapacitated. If the airbags havedeployed (and if the internal sensors are able to detect that fact) thenit is safe to assume that the driver will be extremely disoriented bythe airbag for at least a certain amount of time, such as 1-2 seconds,and often longer. If the peak acceleration has exceeded a predeterminedhuman tolerance limit, then the driver may be assumed to be disabled.However, if the driver manages to apply the accelerator or brakes orsteering at any time post-collision, then the driver is assumed to beresponsive. In one version of the invention, the system would simplyrelinquish control to the driver if responsive, after informing thedriver that the system is ready to do so. In another version, the systemcontinues to control the vehicle until all threats have passed.Alternatively, the system may take a middle path and compromise betweenthe driver's intent and the selected strategy. It is hard to knowwhether to trust the automatic system or the driver's instincts in apost-collision emergency because they are both fallible, and thepost-collision scenario is notoriously unpredictable. The science ofautomatic vehicle operation is still developmental at the time ofwriting, and so caution would dictate that the automatic system shouldrelinquish control to the driver if responsive. However, the reliabilityof automatic intervention systems is rapidly improving, and it is likelythat soon it will be safer to let the automatic system dominate duringany emergency, including post-collision.

The invention optionally includes indirect mitigation means whichcomprise any means other than vehicle velocity control. For example theindirect mitigation means may be configured to turn on the brake lightsor emergency flashers as soon as the collision becomes imminent, so asto alert the following driver. Or, the brake lights could be turned onat some other moment when the invention deems it beneficial. Forexample, suppose the following vehicle is approaching too fast and acollision is imminent. The invention will probably cause the subjectvehicle to positively accelerate in that case rather than decelerate,since the attack is from behind; however it would also be beneficial tosimultaneously turn on the brake lights to cause the following driver tothink that the subject vehicle is slowing down and thus prompting thefollowing driver to hit the brakes. The ability to illuminate the brakelights while coasting or accelerating forward is a valuable safetyoption.

Activating the emergency flashers or the backup lights may further alertthe following driver, thereby prompting the following driver to takeavoidance action sooner or more aggressively than otherwise. Theinventive system may also sound the horn or flash the headlights toalert the leading driver, perhaps causing the leading driver to releasehis brakes and move forward, thereby avoiding or at least softening thesubsequent collision. It would also allow the occupants of the leadingvehicle to brace themselves or otherwise prepare for a collision,reducing overall harm.

Indirect mitigation may include unconventional means for signaling otherdrivers that an emergency is occurring. It is often difficult todetermine how rapidly another vehicle is stopping, and the brake lightsprovide no quantitative information. The following driver has no way toknow that the vehicle ahead is indeed braking very hard until it becomesvisually apparent that the separation distance is closing too fast, atwhich point it may be too late to avoid a collision. To make mattersworse, the brake lights often cannot be distinguished from the runninglights at night or at dusk or in fog. Therefore the indirect mitigationsteps may include sending a visual signal indicating that the subjectvehicle is indeed braking very hard. Such signaling means may include,for example, causing the brake lights to illuminate extra brightly, orto flash bright-dim-bright rapidly, or to alternate left-right-left, orother distinctive signal using the brake lights. The signaling mayinclude turning on other lights in addition to the brake lights, such asthe emergency flashers, or causing the turn signals to rapidly alternatebetween left and right, or turning on the white backup lights, orturning on various lights according to how strongly the subject vehicleis decelerating. For example the normal brake lights could be turned onfor a regular slowing, then adding the emergency flashers for a moreaggressive deceleration, and then adding the backup lights flashingleft-right in a panic-stop situation.

Indirect mitigation also includes keeping the driver of the subjectvehicle informed throughout the analysis and implementation process. Theindirect mitigation includes providing a visual or acoustical or hapticalarm to let the driver know when a collision is imminent, andpreferably the alarm includes an indication of the direction of thethreat so that the driver can take corrective action before thecollision becomes unavoidable. For example the imminent collision alarmmay be a characteristic sound generated by a speaker or solid-statebeeper or other sound generator. Or, more preferably, a plurality ofsmall beepers could be mounted in the subject vehicle to indicate thedirection of the threat. Also, the pattern of sound could be variedaccording to the rate of approach, a rapidly modulated sound indicatinga rapidly approaching threat for example. Preferably, the vehicle soundsystem would be silenced as soon as a collision became imminent, toavoid distractions and to enable the driver to interpret the acousticalalarm more readily. The occupants could use this warning to bracethemselves or hang on in anticipation of a crash, thereby preventingmany injuries.

Alternatively, a voice-like message may be generated such as “Slow down,blockage ahead!” or other information that the driver could use to avoidthe hazard before it became necessary for the automatic system tointervene.

As a further alternative, visual indicators may be illuminatedindicating that a hazard is developing, such as a flashing indicator onthe dashboard, an icon reflected in the windshield or other heads-updisplay, or flashing lights arranged around the periphery of the ceilingas described for beepers. Such flashing lights could be combined withthe sound generators to provide a modulated visual alarm synchronizedwith the modulated sonic alarm, to further inform the driver of thehazard direction and proximity. Drivers who may be hard of hearing wouldappreciate the visual alarms, especially those who have limited abilityto discern direction from sound. Preferably the light flashes would bedimmed at night to avoid flash-blinding the driver, and made brighter indirect sunshine to ensure visibility.

The indirect mitigation means further includes informing the driver whenthe automatic system takes over control of the vehicle. Every driverwill find it disconcerting to suddenly lose control even as a threat israpidly evolving. The inventive system minimizes this, and enlistsdriver cooperation, by clearly indicating that it is taking over andimplementing emergency mitigation steps. The indication may beacoustical, such as a tone or sound different from that used to indicatean approaching threat, or a voice-like message, or a sound coordinatedwith a visual indicator. In addition, a haptic indicator may be used toinform the driver that the brakes or steering are being controlled bythe system, for example with a vibrating or other easily discerniblehaptic being generated right on the brake pedal or the steering wheel,whenever the system forces braking or steering actions. Or, a hapticvibe could be delivered to the steering wheel whenever the automaticsystem takes over regardless of which controls are actually beingexercised, since sometimes the driver is not in contact with the brakepedal for example.

Indirect mitigation further includes informing the driver when theintervention is complete and control of the vehicle is being returned tothe driver. Prior-art system generally neglect this important step. Thedriver needs to know when to resume controlling the vehicle, or elseanother emergency is likely to occur in the very near future. Thereforethe system provides a message, such as computer-generated speech or apre-recorded announcement, stating that control is being turned over tothe driver. In addition, the system may continue to control the vehicleafter such a message until the driver actually takes control. Forexample the system would continue to drive the vehicle until the driverasserts control by operating the steering wheel or brakes or acceleratoror other control. In the excitement and noise of a post-collisiontransition, the driver might not hear a message that the system is readyto relinquish control. Or the driver may be disoriented from air-bagdeployment, or may be otherwise incapacitated. In all cases the systemguides the vehicle safely until the driver takes over. However, if thedriver fails to assert control after repeated messages, the system maydrive to the side of the road and stop, and send a help-request messageor other strategy to help the driver.

The indirect mitigation may in some implementations further includealerting all the occupants when a collision is about to occur, such as“Hang on, we're being hit from behind!” immediately before impact. It isbelieved that such preparatory information would greatly reduce theperiod of disorientation from airbag deployment, thereby enabling thedriver to quickly recover post-collision, and also enabling theoccupants to be prepared to exit the vehicle or whatever is requiredafter the collision. A simple message would not stop the collision, ofcourse, but it could save many lives nevertheless through these indirectmeans.

The system may include adjustment means whereby the driver can selectwhen and how the invention provides automatic assistance. The adjustmentmeans is any user-variable electrical or mechanical or softwareinterface or control, which the driver can adjust to a particularsetting, and which the processor can read or evaluate, thereby allowingthe user to adjust a parameter in the processor such as an interventionthreshold. The adjustment means may be a knob or switch or button, or aselector widget, or slider displayed on a touchscreen, or avoice-activated parameter adjustable by voice commands, or any othermeans for a human to set a parameter that a processor can read. Theadjustment means may be continuously adjustable or have discrete steps.It may be adjustable only at certain times, such as after the engine hasstarted but before the transmission is engaged, or it may be adjustableonly under certain circumstances, such when a driver password isentered. Further examples of adjustment means are provided in FIG. 15.The adjustment means may include insignia or lights or other displaymeans showing the selected adjustment setting, or it may be blind. Theadjustment means may be automatically self-resetting, for example byreturning to a default setting each time the engine is turned off, sothat the driver must reaffirm a preferred setting each time the car isstarted. Multiple adjustment means may be provided, with each adjustmentcontrolling a different operational parameter of the automatic system.

The setting, to which the driver has set the adjustment means,influences the strategy that the system implements. For example, theadjustment means may determine a delay interval, such that the automaticsystem would delay any intervention for the selected delay interval.Typically the system first detects that a collision is imminent, thenwaits for the selected delay interval, thereby giving the driver anopportunity to resolve the problem, then checks if the threat persists,and only then implements the intervention strategy. Alternatively, theadjustment setting may determine a hazard threshold, such that theautomatic system would intervene only if the threat level exceeded thatthreshold. Thus the automatic system would not respond to an imminentcollision at low speeds, but would intervene fully for a threat athighway speeds. As a further alternative, the adjustment means may setan amount of assistance, so that the intervention would range from aminimal to maximal assistance. Thus a minimal assistance setting wouldcause the system to modify the driver's actions only slightly, whereas amaximal assistance setting would enable the automatic system to takeover completely. At intermediate settings, the intervention may be acompromise between the driver's actions and the planned strategy.

In a first version of the adjustment means, the setting controls thehazard intervention threshold. The adjustment means is a multipositionswitch mounted on the dashboard. The switch positions may be labeledaccording to several increasing degrees of hazard, ranging fromlow-hazard to high-hazard. For example the highest position could belabeled “Extreme Emergencies Only”, meaning that with this setting thesystem would intervene only when a collision is likely to be a seriouscollision; hence the setting is associated with a high interventionthreshold. The next switch position could be labeled “Imminent Hazards”,then “Possible Threats”, and finally “Routine Adjustments” at successiveswitch positions, each such setting being associated with a lowerintervention threshold.

The driver could thereby adjust the degree of hazard at which the systemwould intervene, and then the system would provide automatic assistanceonly if the evaluated degree of hazard of the imminent collision exceedsthe intervention threshold associated with that setting. Thus a skilledand confident driver may select Extreme Emergencies Only, while aless-skilled driver might select the lowest threshold level to obtainautomatic assistance under more routine circumstances (that is, aless-skilled driver may appreciate and employ the automatic assistancenot only in an emergency, but also in routine situations such as keepingcentered in the lane or regulating the distance from the car in front).As a further option, the lowest intervention threshold setting may be afully driverless operation, such that the automatic system drives thecar 100% of the time unless the driver takes over. Thus the adjustmentmeans allows the driver to select between a driverless(processor-driven) mode and a regular (human-driven) mode, depending onwhether the driver desires to drive the car or not.

Table 1 lists a different intervention threshold scheme, based onevaluating the degree of hazard according to the collision time and theprobability of collision. Many other intervention thresholds arepossible, reflecting different ways of evaluating a degree of hazard.

TABLE 1 Intervention Thresholds Immediate, high-probability threatsImpending, medium-probability threats Delayed, lower-probability threatsLong-term, low-probability threats

In a second version of the adjustment means, the setting controls adegree of assistance, such that the automatic system will exert more orless control over the vehicle depending on the setting. For example, theautomatic system may adjust the prepared strategy according to thesetting, which would modify the brake control signals to be a compromisebetween the amount of braking that the strategy calls for and the amountthat the driver imposes with the brake pedal. Likewise the throttlecontrol signals and the steering control signals could be modifiedaccording to the setting of the adjustment means. In one version, thedriver may turn a knob which determines whether the system willcompletely take over the operation of the car in an emergency, or at adifferent setting would revise the driver's actions only slightly. Inthat case the degree of assistance is a weighting parameter ranging from0% to 100%, where 0% corresponds to no assistance even in an emergency,10% means that the system would provide only gentle or slight variationsupon the driver's actions, 50% corresponds to averaging the inputs fromthe driver and the automatic analysis with equal weights, and 100%corresponds to the automatic system completely taking over in anemergency regardless of any driver actions. Thus a low setting of thedegree of assistance would allow the automatic system to provide onlysmall adjustments to the driver's braking or steering actions, whereas adriver who wishes to retain some level of control in an emergency canset the adjustment means to an intermediate position, and yet a thirddriver may decide to allow the automatic system to fully operate thevehicle in an emergency. Of course the system relinquishes control backto the driver as soon as the emergency is past (unless the driver hasrequested full-time fully-autonomous driving).

A different example of the degree of assistance is shown in FIG. 18.Here the three levels of assistance are Low, Medium, and HighAssistance, with the corresponding settings of, respectively, “Warnonly”, “Relinquish on demand”, and “Intervene until safe”. With the LowAssistance selection, the system issues a machine-generated speechwarning that a collision is imminent. It may further provide anindication of the type or direction of the threat, such as “Right sideencroachment!”, or an estimated collision time, or other helpfulinformation. However with Low Assistance the system would not intervene,other than issuing the warning. With the Medium Assistance selection,the system would issue the same warning, and also would take overcontrol of the vehicle when a collision is imminent. However, the systemwould then relinquish all control back to the driver if the driverasserted control by, for example, forcefully operating the steeringwheel or brake or accelerator in conflict with the system control. Withthe High Assistance selection, the system would again issue the warningmessage, and would take over control, but would not release controluntil all imminent hazards have cleared.

In a third version of the adjustment means, the setting corresponds to adelay interval. The driver can set the delay interval from zero (nodelay) to as long as 1-3 seconds for example. When the automatic systemdetects an imminent collision, the system would then wait for a timeequal to the selected delay interval and then, if the collision is stillimminent at that time, would begin the selected mitigation strategy.This would give the driver time to react and perhaps avoid thecollision. The delay interval setting makes sense if the driver believesthat the automatic system would not be able to handle emergencysituations as well as the driver, and therefore the driver wants to makethe first avoidance attempt. However the automatic system would thentake over if the driver's strategy does not work within the selectedtime limit. There are probably many situations where a skilled humancould do better than the machine, but a less-skilled driver wouldprobably not do as well as the automatic system. Therefore theadjustment means allows the driver to select the amount of delay thatwould be appropriate.

A system according to present principles may further include means forrecording data on each event that requires an emergency intervention.The system would also record data on each collision, and on othertraffic events of significance. The recorded data preferably includessufficient detail to enable each intervention event to be reconstructedand its causes identified with high certainty. At minimum the recordeddata should include detailed data from the internal sensors indicatingthe velocity and acceleration of the subject vehicle for a period oftime, 10 minutes for example, leading up to the collision orintervention, as well as real-time data on the status of the acceleratorand brakes and steering, and possibly other internal sensor data such aswhether the radio was being fiddled with, or other potentialdistractions. Such real-time data may comprise data accumulated everymillisecond, or every second, or at other time intervals depending onthe measurement speed of the sensor and other factors. The recorded datashould further include summaries of the external sensor data such asdistances and velocities and locations of various vehicles around thesubject vehicle during the pre-collision period, plus representativeimages.

The recorded data should also include the type of automatic interventionprovided, including detailed timing of events leading up to theintervention, and whether the collision was found to be avoidable orunavoidable, and the exact sequence and strategy selected, and whetherthat strategy was successfully implemented. The settings of anyadjustment means should also be recorded.

If a collision occurred, a complete record of the sensor data during thecollision period should be recorded, as well as detailed traffic andinternal data during the post-collision period. If any indirectmitigation was attempted, this should be recorded. Any help-request orother transmitted messages should be recorded.

The recorded data should be updated continuously into a shielded,password-protected, non-volatile, hardened memory. Then, shortly after acollision or intervention, the last 10 minutes (or other period) of therecord would be sealed so as to protect it from being overwritten, and anew record would be started in a different region of the memory. In thisway multiple collisions or interventions can be fully documentedincluding the period leading up to the collision or intervention,whereas all the non-emergency data would be overwritten in due course.Ample hardened memory should be provided for at least several suchevents to be recorded and preserved.

Alternatively, the data may be stored in regular volatile memory, beingupdated continuously and older data overwritten continuously until acollision becomes imminent. Then, the most recent 10 minutes (or otherinterval) of data would be quickly copied from the regular memory intothe special hardened non-erasable memory for protection. Also, after acollision, the collision data would be copied into the non-erasablememory as well. Automatic uploads to a cloud or other server may also beconfigured, such that collision data is automatically stored in alocation of the user's choosing.

The recorded data may be reviewed by any authorized person, such as thedriver, the police, and insurance companies for example. Passwords maybe used for restricting access. In one version, an insurance companyoffers discounts to customers who permit them to review the stored data,and further discounts if the data indicates that the driver had few orno interventions, in the same way that drivers with no tickets getbetter rates. A good driver should never, or almost never, requireautomatic emergency intervention.

Turning now to the drawings, FIG. 1 shows how a collision scenario mayproceed when a prior-art automatic braking system is employed. Thescenario involves successive views of three cars at three successivetimes. The scenario ends in a needless collision, primarily because theprior-art system failed to account for the velocity of the followingvehicle.

At time t=0, in a lane of traffic demarked by lines 100, there are shownthree automobile icons representing a leading vehicle 101, the subjectvehicle 102, and a following vehicle 103. A block arrow such as 105indicates when each vehicle is moving; and when the vehicle is stopped,there is no arrow.

The subject vehicle 102 includes a prior-art automatic braking systemrepresented as an open hexagon 108. The prior-art system 108 does notmonitor traffic to the rear and thus cannot detect the following vehicle103.

The traffic lane is repeated at three sequential times indicated as t=0,t=T1, and t=T2. For example, T1 may be 1 second and T2 may be 2 seconds.Dashed arrows such as 106 show how each vehicle's position shifts ateach time. Thus the figure shows how each car moves during the scenario.

Initially, at t=0, the leading vehicle 101 has suddenly stopped. Thesubject vehicle 102 and the following vehicle 103 are travelling forwardbecause their drivers have not yet realized that the leading vehicle 101has stopped.

At time T1, the prior-art automatic braking system 108 on the subjectvehicle 102 has detected that the leading vehicle 101 has stopped, andhas brought the subject vehicle 102 to a stop as rapidly as possible.Meanwhile, the following vehicle 103 is still traveling forward, but nowthe following driver sees that the subject vehicle 102 has stopped andapplies his own brakes in panic.

At time T2, the following vehicle 103 has collided with the subjectvehicle 102 because there was insufficient time for the followingvehicle 103 to stop. The source of the problem was the prior-art brakingsystem 108, which stopped the subject vehicle 102 too rapidly, leaving alarge space 109 between the subject vehicle 102 and the leading vehicle101, thus depriving the following vehicle 103 sufficient time to stop.

FIG. 2 shows a similar scenario, but now guided by the inventivecollision mitigation system. The invention detects that a collision isimminent but avoidable, and applies a collision-avoidance strategy. Theoutcome is a near-miss but no collision.

At time t=0 the leading vehicle 201, the subject vehicle 202, and thefollowing vehicle 203 are in a travel lane, but the leading vehicle 201has suddenly stopped. Fortunately, the subject vehicle 202 now includesa collision mitigation system according to present principles,represented as a filled triangle 208. The collision mitigation system208 detects that the leading vehicle 201 has stopped, and also that thefollowing vehicle 203 is approaching, and measures their velocities andaccelerations, and updates the kinetic traffic model, determines that acollision is imminent, determines that the collision is avoidable with aparticular sequence of positive accelerations or decelerations orsteering, and applies a collision-avoidance strategy accordingly. Inthis case the collision-avoidance strategy comprises applying the brakesbut not too hard, thereby bringing the subject vehicle 202 close to, butnot in contact with, the leading vehicle 201. Alternatively, andpreferably, the system 208 arranges to apply the brakes very hard atfirst to alarm the following driver, and then with precision timing toease up on the brakes so that the subject vehicle 102 will coast in veryclose to the leading vehicle 101. This latter sequence gets thefollowing driver's attention early in the scenario, as desired. It alsoensures that any unintended contact between the subject vehicle 102 andthe leading vehicle 101 will be very light because of the very low speedof the subject vehicle 102 as it draws closer.

Then at time T1 the subject vehicle 202 has stopped, mere centimetersfrom the leading vehicle 201, while the following vehicle 203 is stilltraveling forward but is braking because the driver of the followingvehicle 203 has seen that the subject vehicle 202 was slowing down, orsaw the brake lights of the subject vehicle 202.

At time T2 all three vehicles 201, 202, 203 are stopped close to, butnot contacting, each other. The following vehicle 203 was able to stopin time because the subject vehicle 202, guided by the collisionmitigation system 208, allowed sufficient distance for the followingvehicle 203 to stop.

Most human drivers would have extreme difficulty performing thismaneuver because it is too difficult to know exactly when to ease up onthe brakes; but the collision mitigation system 208 with its 64-bitprecision should be able to make it work, every single time.

FIG. 3 shows another scenario with three cars, but here the collision isunavoidable. A system according to present principles applies aminimum-harm strategy and manages to protect the occupants of all threevehicles from life-threatening injuries.

At time t=0, the leading vehicle 301 has stopped, the subject vehicle302 is travelling, and the following vehicle 303 is travelling. Theadjacent lanes are blocked by other cars (not shown). The collisionmitigation system 308 in the subject vehicle 302 detects that theleading vehicle 301 has stopped, and also that the following vehicle 303is rapidly approaching, and also that lateral motion would be extremelyharmful. The collision mitigation system 308 analyzes the situationusing its predictive traffic model and determines that a collision isimminent and unavoidable, given the speed and distance of the followingvehicle 303.

The collision mitigation system 308 selects a harm-minimization strategythat prioritizes saving lives over hardware damage. Theharm-minimization strategy in this case comprises applying positiveaccelerations and decelerations to the subject vehicle 302 so as to keepthe subject vehicle 302 centered between the other two vehicles as theycome together. This strategy also ensures that the velocity of thesubject vehicle 302 approaches one-half the velocity of the followingvehicle 303 (since the leading vehicle 301 velocity is zero). The threevehicles are seen at time T1 coming closer together while the subjectvehicle 302, guided by the collision mitigation system 308, remainscentered between the other two vehicles.

At time T2 the vehicles simultaneously collide. The harm in this type ofcollision is minimized for several reasons. By arranging to have avelocity midway between the leading and following vehicles 301 and 303,the subject vehicle 302 ensures that the peak acceleration experiencedby any of the vehicles is minimized. Secondly, the strategy minimizesthe amount of kinetic energy liberated in the collision. This can beseen from the fact that the kinetic energy available to any collisionbetween two vehicles is proportional to their relative velocity squared.Reducing the relative velocity by a factor of 2 thus reduces the kineticenergy of that collision by a factor of 4. With two simultaneouscollisions, each having one-fourth the energy, it is equivalent to asingle collision with one-half of the energy that a full-velocity impactwould deliver. Any other velocity of the subject vehicle 302 wouldresult in a more energetic collision, and hence more damage and injury.Although the subject vehicle 302 would likely be totaled under thisstrategy, since it experiences collisions to both front and rear, thestrategy maximizes the likelihood that everyone could walk away.

A further advantage of the selected strategy is that it preserves theoption of switching to a collision-avoidance strategy in case thefollowing vehicle 303 manages to slow down sooner than expected, forexample if it happened to have superior tires freshly installed or ifthe driver had great reflexes. The collision mitigation system 308watches for that possibility throughout the scenario, by measuring theactual deceleration of the following vehicle 303, and by updating thekinetic traffic model to see if the prediction has changed to anavoidable collision. And, if the collision did indeed become avoidableat the last moment, then the collision mitigation system 308 wouldinstantly switch to an already-calculated collision-avoidance strategyinstead. In this case that would mean detecting that the followingvehicle 303 has safely slowed down, then applying the brakes hard enoughto stop before hitting the leading vehicle 301. By dynamically adaptingthe mitigation strategy to exploit any improvements in the conditions,the collision mitigation system 308 may thus be able to prevent thecollision entirely.

As a further option, the collision mitigation system 308 may apply otheractions besides acceleration and deceleration to minimize the harm. Forexample, the collision mitigation system 308 may illuminate the subjectvehicle's brake lights immediately upon determining that a collision isimminent, and not waiting for the mechanical braking system to turn onthe brake lights some milliseconds later. This would prompt thefollowing vehicle 303 to begin slowing down a little sooner, potentiallymaking a big difference in the outcome. In addition, the collisionmitigation system 308 may do things to prompt the leading vehicle 301 tomove forward, such as flashing the headlights and sounding the horn.Even a small forward velocity in the leading vehicle 301 would make abig improvement in the collision energy and peak acceleration, even ifit meant that the leading vehicle 301 might contact the car in front ofit. In general when lives are at stake, it is better to distribute thecollision energy among as many vehicles as possible even if all of thevehicles end up damaged; however if injury is unlikely and total damageis the main issue, then it is usually better to contain the collision tofew vehicles.

FIG. 4 shows how a side-encroachment collision may be avoided accordingto a system according to present principles. The figure shows traffic inthree lanes of a multilane highway, each lane demarked by lane lines400, each vehicle indicated by an icon, and all vehicles traveling insubstantially the same direction, and with any lateral motionsspecifically indicated. The subject vehicle 401 includes an emergencyresponse system 402 according to present principles, as indicated by atriangle. The leading vehicle 403 and the following vehicle 404 are inthe same lane as the subject vehicle 401, while an encroaching vehicle405 is in the lane to the right side of the subject vehicle 401, and anopposite vehicle 407 is in the lane to the left of the subject vehicle401. The encroaching vehicle 405 is approaching the subject vehicle 401,as indicated by the arrow 406 which indicates the encroaching vehicle'svelocity and direction. Responsively, the system 402 senses theencroaching vehicle 405, analyzes the encroaching vehicle's velocity406, determines that a collision is imminent, analyzes the position ofthe following vehicle 404, and determines that a strategy of applyingthe brakes would cause a collision with the following vehicle 404 whichis too close. Instead, the system 402 considers another strategy byanalyzing the position of the opposite vehicle 407 along with theacceleration capabilities of the subject vehicle 401, and determinesthat the collision can be avoided by accelerating and steeringsimultaneously so as to enter the opposite lane without hitting theopposite vehicle 407. The system 402 then causes the acceleration meansand steering means to carry out that strategy. The solid arrow 408 thenindicates the subject vehicle's acceleration during this maneuver.

It is important to note that, generally, human drivers would not attemptsuch an acceleration-swerve maneuver because most human drivers cannotaccount for the positions and velocities and accelerations of thevarious vehicles quickly enough, nor control the maneuver preciselyenough, to guarantee success. Most human drivers would simply hit thebrakes to avoid being side-swiped by the encroaching vehicle 405. Mosthuman drivers would not be able to tell visually that the followingvehicle 404 is too close, and if they did know that, they still wouldnot have time to figure out a better strategy. The system 402, on theother hand, operates much faster than the human mind since it includes ahigh-speed computing means, and further has the advantage of sensorsthat provide precise real-time data on the other vehicles' positions andvelocities. In addition, the system 402 is able to control theacceleration means and steering means more precisely than any humandriver could, since the system 402 includes electrical linkages (notshown) which may be controlled by feedback from on-board sensors (notshown). In summary, most human drivers would either slam on the brakes,leading to a collision with the following vehicle 104, or swerve to theleft, leading to a collision with the opposite vehicle 407; however thesystem 402 successfully navigates a safe path and avoids all collisionswith all the other vehicles.

FIG. 5A shows a similar scenario, with the encroaching vehicle 505trending to the left as indicated by arrow 506, but now with theopposite vehicle 507 farther forward than in FIG. 4, thus preventing thesubject vehicle 501 from accelerating to the left. Also, the subjectvehicle 501 now contains a prior-art collision-avoidance system 512shown as a hollow triangle. The prior-art system 512, like mostprior-art collision-avoidance systems, would do exactly what a humandriver would do, which is to apply the brakes and hope for the best. Inthis case that option is not very good. The resulting collision issketched in FIG. 5B which shows the encroaching vehicle 505 collidingwith the subject vehicle 501 as expected. Since the subject vehicle 501has partially decelerated, the subject vehicle 501 strikes theencroaching vehicle 505 in the rear quarter of the encroaching vehicle505. Such a collision often results in deep penetration of the passengercompartment of the encroaching vehicle 505, thereby causing grave injuryto the passengers of the encroaching vehicle 505. In addition, therear-quarter collision would likely cause the encroaching vehicle 505 tospin out, as indicated by the curved arrow 509, because the torquedelivered to the encroaching vehicle 505 by the collision force wouldlikely cause the rear wheels of the encroaching vehicle 505 to slipsideways, thus forcing the encroaching vehicle 505 to rotatecounter-clockwise violently. A spin-out at freeway speeds is one of themost dangerous types of collisions. In such a spin-out, the encroachingvehicle 505 would likely proceed around to the left, dragging across thefront of the subject vehicle 501, and then slam into the oppositevehicle 507. An instant later, the following vehicle 504 would then plowinto the tangle of cars. Numerous serious injuries would likely result,especially for the occupants of the encroaching vehicle 505.

FIG. 6A shows the same initial scenario as FIG. 5A, with the oppositevehicle 607 still blocking the subject vehicle 601, and with theencroaching vehicle 605 rapidly closing in. But now in this case thesubject vehicle 601 contains a system 602 according to presentprinciples, which manages the collision much better. The system 602quickly assesses the kinetics of the other vehicles, concludes that acollision is unavoidable, evaluates a wide range of mitigationstrategies, and selects the mitigation strategy with the minimumestimated harm. In this case, the minimum-harm strategy is to accelerateforward, as indicated by the solid arrow 609, so as to move the subjectvehicle 601 essentially even with the encroaching vehicle 605. Thisstrategy accomplishes several desirable things. First, it makes thesubject vehicle 601 more visible to the driver of the encroachingvehicle 605, which might prompt the encroaching driver to turn away andavoid the collision altogether. But here we assume that the encroachingdriver still does not or cannot take evasive action, and so thecollision proceeds as shown in FIG. 6B. As can be seen in FIG. 6B, andunlike the case of FIG. 5B, the collision now occurs at the frontquarter of the encroaching vehicle 605, and then becomes spread outalong the whole sides of the two vehicles. This is a softer and far lessdangerous collision, because (a) the front-quarter collision would tendto straighten the encroaching vehicle 605, and (b) the collision issofter and spread out, thus limiting the peak acceleration, and (c) thecollision forces would tend to bounce the encroaching vehicle 605 backinto the right lane rather than across to the left. The arrow 610 showsthe acceleration of the encroaching vehicle from such a collisionaldeflection. The encroaching vehicle 605 is thus deflected back towardthe right lane and away from the other vehicles. The encroaching vehicle605 is much less likely to go into a spin in this case because it hasnot received much torque from the flat collision; but if it did spin, itwould tend to spin to the right and away from the other cars, probablyending up in the shoulder.

Another advantage of the selected strategy is that the collision isrelatively soft, distributed across the whole side body of theencroaching and subject vehicles 605 and 601, rather than concentratedin one panel, and therefore the passenger compartments would tend toremain intact. Indeed, the side airbags might not even be triggered inthis mild collision scenario.

Another advantage is that by accelerating, the subject vehicle 601 hasopened up extra space for the following vehicle 604 to stop, therebypreventing a possible secondary collision with the following vehicle604. No prior-art system, and probably no human drivers, would dareselect a forward acceleration as the minimum-harm strategy in such ascenario. But with the aid of the system 602, an imminent collision thatcould have expanded into a very serious pileup was mitigated optimally,and indeed turned out to be just a minor fender-bender.

The system 602 may also apply indirect mitigation steps to furtherminimize the expected harm. For example, the system 602 may cause thesubject vehicle brake lights (not shown) to be illuminated as soon asthe collision became imminent, and then to keep the brake lightsilluminated even while the subject vehicle 601 accelerated forward, eventhough the brakes were not applied at all during that time. The effectof the brake lights is to cause the following vehicle 604 to immediatelyslow down, which further helps avoid a collision with the subjectvehicle 601.

The inventive system 602 may also cause other secondary mitigationactions such as sounding the horn. This would alert the opposite vehicle607, possibly causing the opposite vehicle 607 to brake, which wouldopen up valuable space around the colliding vehicles. The horn may alsoprompt the leading vehicle 603 to speed up and pull away from thecollision site. Other vehicles farther back would also be alerted thatsomething hazardous is occurring in the highway.

One concern with the scenario of FIG. 6B is that the collision maydeflect the subject vehicle 601 to the left, which might cause thesubject vehicle 601 to hit the opposite vehicle 607 or go into a spin orother loss of control. To avoid such an outcome, the system 602 includesmeans for analyzing the collision dynamically both before it occurs andwhile as the collision proceeds, adapting the strategy as needed. Inthis case, the system 602 may apply the right rear brake only, for amoment after the initial contact, to counteract any torque delivered tothe subject vehicle 601 from the collision, thereby ensuring that thesubject vehicle 601 exits the collision still traveling straight in thecenter lane. If however the collision resulted in a larger deflection orskid of the subject vehicle 601, the system 602 would detect the motionand would quickly devise a corrective strategy to bring the subjectvehicle 601 back under the driver's control.

While it is not possible to pre-program specific responses to everyhazard situation, the system is configured to explore a wide range ofinterventions, preferably starting with certain well-establishedmaneuvers but adapting them to the current situation by varying allparameters to obtain optimal results in any unforeseen circumstance. Thesystem uses multiple sensors to detect hazards sooner and moreperceptively than any human driver could, and to quickly recognize whena collision is avoidable by use of competent computing power, and todevelop a better harm-minimization strategy than any human could sincethe processor is unaffected by panic or fatigue or distraction or fearfor its own life. In addition, if a novel strategy turns out well, thesystem may record the sequence of actions in a file, so that it can beadded to the library of maneuvers that other vehicles could consider insimilar situations. Likewise the system may record the steps of astrategy that failed to work as expected, so that on reanalysis thedeficiency may be uncovered and corrected.

Although not shown in the figure, the system 602 includes means forinforming the driver and occupants of the subject vehicle 601 that thecollision is imminent. In this case the alerting system comprises eightsound generators with built-in light flashers, distributed around theceiling of the subject vehicle 601, plus a computer-generated voiceprovided over the regular sound system. As soon as the collision becameimminent, the vehicle sound system was interrupted, the right-sidebeeper and flasher were activated with a medium-frequency modulationindicating that the encroaching vehicle 605 was approaching from theright but still not too fast. Then as the system began implementing theharm-minimization strategy by taking over the acceleration,deceleration, and steering means of the subject vehicle 601, a hapticvibe device in the steering wheel informed the driver that the systemhad taken over control of the vehicle. Then, just before the collision,the sound system was turned back on with the message “Collision! Rightnow!”. The driver and occupants would have a brief but sufficient momentto prepare for the impact, resist the strong lateral forces when theyoccur, and anticipate airbag deployment as expected. As a result, liveswould be saved and injuries lessened in what otherwise would be a veryserious accident.

FIG. 7 shows an emergency situation not involving vehicle-vehiclecollisions, but requiring automatic assistance nevertheless. Here thesubject vehicle is indicated by icons 701, 704, 706, and 708 atsuccessive moments. The system 702 according to present principles isindicated by a filled triangle. A pedestrian 703, or other obstacle, isindicated by a star. Due to fog or other issue, there is insufficienttime for the driver of the subject vehicle 701 to steer away and avoidkilling the pedestrian 703. The inventive system 702 detects thepedestrian 703, recognizes within one millisecond that maximal andimmediate intervention is needed, with no time for warnings or otherdelays, and implements a strong avoidance strategy. The strategy beginsby locking the left rear brake (not shown) and steering to the left soas to rotate the subject vehicle, now shown at position 704, androtating as indicated by a curved arrow 705. Then, in order to slide thesubject vehicle 704 to the left, the right front brake (not shown) isactivated while the other brakes are released. Also, the throttle may bepulsed at this moment, thereby causing the rear wheels to lose traction,and thereby further enabling the vehicle to slide to the left. Thiscauses the subject vehicle, now at position 706, to pivot around thefront right corner, effectively rotating around the pedestrian 703 asindicated by arrow 707. The subject vehicle 706 barely misses thepedestrian 703, but is now in a high speed spin-out and is slidingleftward. To restore control, the system 702 again steers to the leftwhile applying both rear brakes, but not the front brakes, until thefront wheels again have traction. Finally the subject vehicle atposition 708 is traveling straight, and the system 702 returns controlback to the driver. Thus the system 702 recognizes a non-vehiclecollision hazard, and implements an avoidance strategy, and saves a lifeusing a maneuver that prior art systems and most human drivers would notbe able to perform.

Turning now to FIG. 8, a flowchart shows a method according to presentprinciples, in minimal form. Using data from the external sensors, asecond vehicle is detected (801). Future positions of the second vehicleare projected forward in time. Future positions of the subject vehicleare also projected forward in time, assuming that a specificcollision-avoidance sequence of actions is implemented on the subjectvehicle, thereby causing the subject vehicle to accelerate in variousways (802). If the vehicles are projected (803) to avoid a collisionaccording the sequence of actions, then that sequence of actions isimplemented as the “collision-avoidance actions” (805). If however thevehicles are projected to collide for every specifiedcollision-avoidance sequence of actions, then a minimum-harm sequence ofactions is selected (804), by choosing the already-analyzed sequencewith the least predicted harm, and possibly by analyzing furthersequences. Then, the selected “minimum-harm actions” are implemented(806). These steps are repeated as further sensor data becomesavailable, thereby adapting to the changing scenario in real time.

In most cases, in regular driving, the second vehicle is found not to beon a collision course with the subject vehicle, and therefore nocollision-avoidance actions are needed. Preferably, then, the firstsequence to be tested (802) is to simply do nothing (the “nullsequence”). In that case there is no projected collision if the subjectvehicle is driven according to the null sequence, and so the nullsequence becomes the collision-avoidance sequence (805), with no furthersearching. The task is finished.

Of more interest is a case where the second vehicle is on a collisioncourse with the subject vehicle. The null sequence would result in acollision, so evasive action is needed. Although not detailed in theflowchart, the method includes testing multiple sequences of actionscomprising different types, magnitudes, durations, and timing of variousaccelerations of the subject vehicle. For each such sequence, theposition of the subject vehicle is again projected forward in time todetermine if the collision can be avoided thereby. If so, the successfulsequence becomes the collision-avoidance sequence which is thenimplemented (805). If all of the sequences fail to avoid the collision,then a sequence that results in a collision with the least harm isselected as the minimum-harm sequence (804), and it is implemented(806).

Optionally, selection of the minimum-harm sequence (804) may includereanalyzing the various sequences considered during thecollision-avoidance stage (802) as well as other sequences notpreviously analyzed, and calculating the harm expected based on thecollision parameters (such as the relative velocities and point ofcontact of the two vehicles). This obtains the minimum-harm sequence ofactions (804), but it takes extra time for the harm minimizationprojections and analyses (803). Alternatively, the system may store inmemory the collision parameters that are derived for each sequenceanalyzed during the collision-avoidance analysis stage (802), so thatthese results can easily be recalled if they are needed to select theminimum-harm sequence (804). The stored collision parameters for each ofthe unsuccessful collision-avoidance sequences would be used to estimatethe harm for that sequence, and the sequence with the least harm wouldbe implemented (806). This is much faster than reconstructing thevehicle trajectories again if the collision turns out to be unavoidable,and may be useful in addition when like situations are encountered. As afurther time-saving option, the harm associated with each of thesequences may be calculated during the collision-avoidance stage (802),and the estimated harm value may be stored along with the sequence. Thenthe least harm sequence may be selected (804) almost instantly whenneeded, by selecting the stored sequence that has the least harm. Thecollision analysis and harm calculations are preferably carried outusing separate processors or separate cores of a processor, so as not toslow down the parallel tasks.

FIG. 9 shows an alternative method according to present principlesincluding specific determination that a possible collision is imminentand is either avoidable or unavoidable. First, the velocity and positionand other parameters of the other vehicles are measured by the externalsensors (901). Then data from the sensors is used to update (902) apredictive kinetic traffic model that tracks the positions of the othervehicles. The model then projects the vehicle positions forward in timeand determines (903), within certain preprogrammed assumptions, whethera collision is imminent. If so, the model then determines (904) if thecollision is avoidable. If so, then a collision-avoidance strategy isselected and implemented (906), for example by positively acceleratingor decelerating. But if the collision is not avoidable, then aminimum-harm strategy is selected to minimize loss of life or injury,and secondarily to reduce the damage of the collision (905). While thescenario is ongoing, all the steps in the flowchart are continuouslyrepeated, thereby enabling the kinetic model to be updated and thestrategy to be revised according to the new sensor data. Any change inthe avoidability of the collision or anything else in the scenario,would automatically result in a revision of the strategy.

The inventive method further includes calculating the expected harm ofan imminent collision, thereby enabling selection of the best mitigationstrategy. The harm may be calculated by assigning values to variousconsequences, multiplying by the likelihood, and adding them up for eachmitigation strategy. For example, a predicted death may be assigned avalue V1 such as 1,000,000 points, a crippling injury a smaller butstill substantial value V2 such as 100,000 points, a non-cripplinginjury would be V3 such as 10,000 points, and so forth for otherpersonal harms. The model could use the actual number of people in thesubject vehicle as determined by seat-loading or seatbelt monitors whichmost cars already have, and the occupation of the other cars may beestimated as 1.5 per vehicle for example. The estimated number ofoccupants may be modified by a determination of the character of theother vehicle, for example a truck vs. a minivan. In addition, theexpected damage may be estimated as a dollar figure or other value, foreach vehicle involved in the collision, which would be a function of therelative velocities of the vehicles primarily. Then the total harm maybe calculated by multiplying V1 times the number of deaths times theprobability, plus V2 times the number of crippling injuries times thatprobability, and so forth, finally adding the vehicle damages at theend. The predictive model could test various mitigation strategies bycalculating the overall harm for each strategy in this way, and selectthe strategy with the least expected harm. Alternatively, if at leastone fatality is predicted, then the calculation may drop the propertydamage term entirely since it would be improper to allow damage concernsto modify, even slightly, a life-saving endeavor.

As an alternative, the method could comprise detecting a second vehicle,then preparing an avoidance strategy comprising a sequence of actions toavoid a collision with the second vehicle, but without ever explicitlycalculating the imminency or avoidability of the collision. Normally,the first avoidance sequence tested would be to simply do nothing (thenull sequence), and in most cases the vehicles would pass harmlessly byeach other. In that case the avoidance sequence is the null sequence andthe task is done. If however the null sequence fails to avoid acollision, then a wider range of sequences would be explored, and if oneof them avoids the collision, that sequence is selected as the avoidancesequence. And, if none of them is able to avoid the collision, then thecollision is unavoidable, and a harm-minimization sequence is selectedinstead.

Further variations of the collision-avoidance sequences may be tested inthe same way, continuing until an unavoidability criterion is met. Theunavoidability criterion may be that a predetermined time has expired,or until a certain number of sequences or acceleration parameters havebeen tested, or other criterion. Then, if multiple sequences aresuccessful in avoiding the collision, the best one may be selected, forexample the sequence involving the least amount of accelerationnecessary to avoid the collision. However if none of those sequencesavoids the collision, then the collision is unavoidable and theharm-minimization stage would begin.

In similar fashion, the sequences considered for minimizing the harm ofthe unavoidable collision may be analyzed until another criterion ismet, which may be termed a “time-is-up criterion”. The time-is-upcriterion may be a time limit, or a time to impact, or a number ofsequences explored, or other criterion. When the time-is-up criterion ismet, whichever sequence has the least expected harm would beimplemented.

As a further option, the system could record in memory the collisiondetails predicted for each avoidance sequence that failed to avoid thecollision. The stored data would include the relative velocity, point ofcontact, and other collision information associated with each sequence.If the collision turns out to be avoidable, this data may be discarded.But if it is unavoidable, the system can rapidly evaluate the harmcaused by each of those collisions, without having to reconstruct eachcollision scenario all over again. Thus the projected collision datafrom the various collision-avoidance sequences would help the system torapidly select the least-harm sequence of actions.

As a further time-saving measure, the harm associated with eachunsuccessful avoidance sequence may be calculated using a second core ofa multi-core processor, even as another avoidance sequence is beingdeveloped. If and when the system concludes that the collision isunavoidable, the least-harm sequence would be available instantaneously.The system would not have to wait for the harm-minimization analysissince it would already be done. As a further option, the bestharm-minimization sequence obtained to date may be implemented as soonas it is analyzed, while further avoidance sequences continue to beexplored in parallel. Then, if a new sequence is subsequently discoveredthat could avoid the collision, the system could switch to itimmediately.

FIG. 10 shows a flowchart of a method according to present principleswherein the collision avoidance and harm minimization calculationsproceed concurrently. As soon as a second vehicle is detected withsensor data (1001), the future positions of the subject vehicle and thesecond vehicle are calculated (1002), initially assuming no evasiveactions are taken. Then, in interrogator 1003, a collision is detectedif the trajectories intersect. If there is no collision, the processends (1004) with no further actions. But if a collision is projected tooccur at interrogator 1003, then the harm of the collision is calculated(1005), and a set of sequential actions is selected (1006) from standardmaneuvers already known. The future positions of the subject vehicle arethen re-calculated (1007) assuming the selected actions are applied tothe subject vehicle. In interrogator 1008 a collision is again testedfor, and if the sequence avoids the collision (that is, if there is noprojected collision when the selected actions are applied to the subjectvehicle), then the selected actions are implemented (1009) and theprocess ends (1010) with the collision being avoided. But if thecollision is still projected to occur (the sequence fails to avoid thecollision), then the harm is calculated (1011) of the collision as itwould transpire assuming that the subject vehicle is acceleratedaccording to the selected sequence. In interrogator 1012, the harm iscompared to the harm of the other sequences. If the selected sequenceproduces the least harm, it is then implemented (1013). Then anothersequence is tested (1014), for example by varying parameters of one ofthe standard maneuvers, or by varying a parameter in the selectedsequence, or by starting over with a different unrelated sequence ofactions. The trajectory is again re-calculated (1007) and the resultingprojected collision analyzed (1008) for avoidability and expected harm,and continuing likewise in a loop. The loop continues for both outcomesof interrogator 1012, the intent being to keep searching for a sequenceof actions that avoids the collision, or at least a sequence thatminimizes the harm of the collision, even while an intervention is inprogress. As soon as a better sequence is found, the method of FIG. 10automatically switches to it.

FIG. 11 shows a more nuanced flowchart of a method according to presentprinciples, including calculation steps, post-collision strategy, andindirect mitigation. First, (1101) the velocity and position and otherparameters of the leading and following and other vehicles are measuredby sensors. Then (1102) data from the sensors is used to update apredictive kinetic traffic model that tracks the positions of thevehicles. The kinetic model then projects the vehicle positions forwardin time and determines, within certain preprogrammed assumptions,whether a collision is imminent (1103). If so, the kinetic model then(1104) determines if the collision is avoidable. If so, then acollision-avoidance strategy is selected (1108) and implemented (1109),for example by steering or decelerating or otherwise accelerating. Butif the collision is not avoidable, then the dynamic collision model isinvoked (1105) using as input the trajectory and relative velocityresults of the kinetic model. The dynamic collision model then analyzesthe collisions according to a large number of possibleacceleration-deceleration-steering sequences, calculating the expectedharm of each (1106). Then, (1107) a minimum-harm strategy is selected tominimize loss of life or injury, and also to reduce the damage of thecollision. While the collision is ongoing, this cycle is repeated andthe model is updated and the strategy is revised according to the newsensor data, and any change in the avoidability of the collision oranything else in the scenario, would automatically result in a revisionof the strategy accordingly. Optionally, a post-collision strategy isalso prepared (1110) to enable further actions after the collision hasoccurred, and to minimize any further damage or injury, for example bymaneuvering to avoid a domino pileup. Also optionally, a series ofindirect mitigation actions are implemented (1111) such as strategicallyflashing the brake lights.

Turning to FIG. 12, a schematic shows the layout of an embodiment of asystem according to present principles, wherein a single multi-purposecomputing means performs all of the data processing and analysisfunctions with a single computing device 1201 (preferably a fastmulti-core device), typically using several separate software routinesto perform the various computing tasks. Here the computing means 1201 islabeled “central processor”. Data from the external sensors 1202,comprising image data 1210, Doppler signal data 1211, and sonar data1212, are delivered to the central processor 1201, presumably by coaxialcables or optical cables or well-shielded high speed parallel busses(not shown but indicated by various arrows). Wireless communications mayalso be employed. Likewise realtime data from the internal sensors 1203includes data on the speed 1213, acceleration 1214 (positive as well asnegative), and yaw 1215 or direction changes of the subject vehicle,which are delivered to the central processor 1201. The central processor1201 analyzes all this data in parallel, thereby deducing the positionsand velocities and accelerations of the other vehicles, and theirseparation distances from the subject vehicle.

The central processor 1201 simultaneously runs the kinetic model 1204which takes the vehicle position-velocity-acceleration data and projectsfuture vehicle positions, including any changes in the subject vehiclevelocity or direction, and projects the future separation distancesbetween the subject vehicle and each of the other vehicles. The centralprocessor 1201 reviews the kinetic model results and detects if and whencollisions are likely to occur. The central processor then runs thedynamic collision model 1205 using these results, thereby calculatingthe expected harm. The central processor 1201 then performs comparisons1206 to select the best sequence of accelerations for collisionavoidance or harm minimization, depending on whether the collision isavoidable or not. The central processor 1201 then prepares anappropriate strategy to implement that sequence, generates controlsignals, and sends the control signals to the subject vehicle controls1207 including the throttle 1216, brakes 1217, and steering 1218.Although the figure shows the kinetic 1204 and dynamic 1205 models andthe compare-select 1206 tasks as extended from the central processor1201 for clarity, in this example they are all performed within thecentral processor 1201 as parallel computing tasks.

Although the arrangement is quite demanding of the central processor1201, current processors are capable of performing as required. Futurecomputing means are expected to greatly surpass current devices, andcost less, so the arrangement is expected to become even more attractivein the future.

FIG. 13 shows an alternative system layout with a large number ofseparate processors or processor components, specialized for eachcomputing task, and interconnected by data lines such as serial ports.There is no central processor, although it would be easy to incorporateone to keep track of the other processors or to act as a human interfacefor example. In the arrangement of FIG. 13, data are provided byexternal sensors 1301 and internal sensors 1302. Image data 1317 areanalyzed continuously by a dedicated image processor 1303, and Dopplerdata 1318 is analyzed by a Doppler processor 1304, and sonar data 1319is analyzed by a sonar processor 1305. These processors perform theinitial analysis and data reduction, thereby generating just a minimalamount of processed data comprising for example the directions andvelocities of the observed vehicles, and little else. That processeddata stream is easily conveyed by a serial port with shielded twistedpair or other low-cost technology. Likewise the internal sensor data1302, from speed sensors 1320, acceleration sensors 1321, and directionsensors 1322, is analyzed by a single vehicle-motion processor 1306,thereby generating a minimal processed data stream output.

The distributed layout of FIG. 13 includes a kinetic model 1307 which isrunning on a dedicated processor or processor component (“Proc.”) 1308,and a dynamic collision model 1311 running on its dedicated processor1312. In the figure, these items are shown as connected boxes. Processedsensor data goes to the kinetic model processor 1308, which analyzesvehicle trajectories forward in time and then passes the results to aselect-and-compare module 1309 with its dedicated processor 1310, andalso passes the results to the dynamic model's processor 1312.

The select-and-compare processor 1310 then determines if a collision isimminent, avoidable, and unavoidable. If unavoidable, theselect-and-compare processor 1310 then compares the estimated harm fromthe dynamic model 1311. In either case, the select-and-compare processor1310 selects the best sequence and informs an implementation processor1313, which translates the sequence into a strategy including controlsignals and indirect mitigation steps. The implementation processor 1313then sends control signals to the vehicle throttle 1314, brakes 1315,and steering 1316 to cause the vehicle to move in accordance with theselected sequence of accelerations, decelerations, and steering.

The figure also shows feedback signals 1323 (dashed arrow) from thevehicle motion processor 1306 to the implementation processor 1313.Whenever the actual measured motion deviates from the motion called forin the selected sequence, the implementation processor 1313 detects thisdeviation using the sensor data and sends the feedback signals 1323 tothe implementation processor 1313, thereby adjusting the control signalsto correct the vehicle motion. Such feedback from the internal sensors1302 to the vehicle control system 1314, 1315, and 1316 ensures that thevehicle actually performs the motions which are specified in theselected sequence, and performs them quite precisely. With the feedback1323, the implementation processor 1313 instantly corrects anyunforeseen problems arising while the strategy is being carried out. Thefeedback 1323 also ensures that the vehicle control can follow thestrategy precisely even after a collision and even when some of thevehicle properties have changed, as long as the internal velocity,direction, and acceleration sensors 1320, 1322, and 1321 are stilloperational. Although there is no way to know ahead of time if thebrakes 1315, for example, have been compromised by the collision, theimplementation processor 1313 in cooperation with the motion processor1306 uses the feedback 1323 to adjust the vehicle controls 1314, 1315,and 1316 in real time to compensate for any such changes. In this waythe system according to present principles does everything possible tokeep the vehicle on track with the selected mitigation strategythroughout the collision event and thereafter.

The various processors in the distributed computing layout of FIG. 13are preferably all different, since they perform very differentfunctions. The motion processor 1306, for example, could probably be aninexpensive microcontroller, which may already come with a 3-dimensionalaccelerometer 1321 built-in, as well as voltage comparators,programmable logic, and a serial port, all for mere pennies typically.The image processor 1303, on the other hand, may be a custom ASIC orfast GPU capable of analyzing fast-frame image data 1317 to extractvehicle features in real time. The kinetic model processor 1308, dynamicmodel processor 1312, and compare-and-select processor 1310 probably areincluded in a single multi-core CPU since there is no reason to separatethem, and any decent unit can run all three simultaneously. Theimplementation processor 1313 is more difficult to specify because thecontrol signals will depend on the vehicle properties, and it willprobably have to generate different output voltages than the otherprocessors. Nevertheless, numerous custom and general purpose controllermodules, plus a few microcontrollers, would be potentially capable ofproducing the needed signals. Developers will have to adapt theimplementation processor 1313 to each type of vehicle, using designengineering well known in the art.

Turning now to FIG. 14, a flowchart shows the steps of a post-collisionmitigation method according to present principles. In box 1401, theinternal and external sensors measure the condition of the subjectvehicle and sense the positions and velocities of other vehicles,generating data and sending it to the computing means for analysis.

In box 1402, the computing means uses the sensor data to update thekinetic traffic model, and detects when a collision is imminent. Ifthere is no current hazard at interrogator 1403, the process returns tobox 1401. But if a collision is imminent, the processor prepares (orupdates) a post-collision strategy in box 1404, while also predictingthe type of collision that is imminent. The computing means continues toupdate the kinetic model 1402 during the collision.

When the collision is over (1405), the computing means first does aself-check (1406) if it is able. In the version shown, the computingmeans terminates its activity (1412) if it fails the self-check. Inother versions, the processor may attempt to secure the vehicle byturning off the fuel pump and unlocking the doors.

If the computing means is still operational, and assuming the sensorsare also still operational, the system checks the recent sensor data tosee if there is oncoming traffic and if a second collision is imminent(1407). If the sensors are not operational, the processor may usepre-collision traffic data to predict if a secondary collision islikely. If so, it initiates the planned evasive action (1408) such asproceeding to the side of the road. If a secondary collision is notimminent, the flow proceeds to box 1409, warning other vehicles of thedanger, for example by flashing lights and sounding the horn. Also atthis point, or earlier in the sequence, the system interrogates theinternal fire-detection sensors, if any, and issues an urgent alarm iffire is detected.

The computing means then takes steps to secure the subject vehicle(1410), for example by turning off the ignition, setting the parkingbrake, unlocking the doors, rolling down the windows.

A difficult situation may arise when multiple threats are detected atthe same time, such as a fire threat and an imminent second collision.In that case, the computing means would implement evasive action first,but would select as brief an evasion as possible, and then immediatelystop and evacuate the occupants without taking the extra time to driveto the side of the road or anything else. The step of warning othervehicles 1409 and all other actions would be delayed until after thefire alarm step, but would proceed thereafter.

Then, after the immediate life-saving actions are completed, the systemthen proceeds to transmit a help request message (1411), assuming it hadnot already done so when the collision became imminent.

After that, the process would terminate (1412). Alternatively, anyfurther steps may be added in various implementations of the invention.

Although not shown in the figure, the computing means may monitor theinternal sensors to ascertain the driver's responsiveness after thecollision, for example using the internal sensors to see if the driveruses the steering or brake or accelerator. In this version, the systemwould relinquish complete control to the driver as soon as the drivertakes any such action. This choice is preferable if the state oftechnology is not yet able to predict the chaotic aftermath of amulticar collision. Thus if the driver is still able to take control,the system will let the driver do so. However, if the driver takes noaction at all after the collision, then the system would assume that thedriver is incapacitated, and would proceed with the post-collisionstrategy as planned. In this way a system according to presentprinciples would do everything possible to save the occupants, whateverhappens.

FIG. 15 is a schematic of a system according to present principles,including adjustment means. The schematic is centered on computing means1501 which maintains a kinetic traffic model and a dynamic collisionmodel, evaluates emerging threats, and selects a mitigation strategy toavoid or minimize any collision. The computing means 1501 takes asinput, data from the internal 1502 and external 1503 sensors. Thecomputing means 1501 also takes as input the user-selected settings ofthe adjustment means, which in this case includes three differentadjustment means. A first adjustment means is a stop-position sliderwhich the driver can set from a high threshold position labeled “MaxHazard” down to a low threshold labeled “Min Hazard” to control theintervention threshold 1504. In the high position, the processoractivates the brakes and other devices only when the collision hazardhas risen to a high level of certainty or severity, and takes no actionif the hazard level is low. In the low-hazard position, the processorintervenes under both minor and major emergency situations.

The second adjustment means is a set of radio-buttons on a displayscreen, by which the driver can select a high or low degree ofassistance 1505 from the automatic system. The setting is used by theprocessor to adjust how much pressure to apply to the brakes or othercontrols, in opposition to the driver's actions; that is, how much toallow the automatic system to override the driver's actions. For exampleif the processor decides that the collision can be avoided by steering20 degrees to the left, while the driver is turning the steering wheel30 degrees to the left, then the amount of steering delivered to thewheels would be a compromise depending on the degree of assistancesetting. With a low setting, the vehicle would be steered according tothe driver's intent of 30 degrees, while a high setting would giveprecedence to the automatic system and steer at 20 degrees. A midrangesetting would correspond to an average of the two inputs, resulting in a25 degree steering outcome.

A third adjustment means is a thumbwheel labeled in milliseconds ofdelay which determines a delay interval 1506. For example, by settingthe delay interval 1506 to 500 milliseconds, the processor will wait forthat time after detecting a hazard before taking any action. Then, ifthe hazard is still present, the processor will actuate the brakes andsteering and accelerator according to the mitigation strategy.

The three adjustments are interrelated. The delay interval 1506 beginswhen the threat level exceeds the intervention threshold 1504. Then,when the delay interval 1506 expires, the system provides only thatamount of intervention permitted by the selected degree of assistance1505. All three adjustable parameters are set by the driver in theversion shown. In this way each driver can choose the type and amount ofassistance desired, based on the driver's assessment of the reliabilityof the automatic system and the driver's own skill level.

If the driver is a beginner or someone with limited judgment, butotherwise an adequate driver, then the invention may include means forconstraining one or more of the adjustments, such as limiting the rangeof the adjustment. For example, the parents of a teenage driver maylimit the range of the delay interval adjustment 1506 to no more than100 milliseconds (in recognition of the great reflexes of a teenager)but also limit the intervention threshold 1504 to no lower than amidrange position (since the young driver tends to underestimate thehazard potential in a variety of situations).

FIG. 16 is a table showing the sequence of actions to avoid a collision.In this scenario, the leading vehicle has slowed down or its brakelights are illuminated, yet the following vehicle is accelerating andunaware of the growing hazard. In analyzing options, the system notesthat the left lane is blocked by a large truck, and the right lane isblocked by a car (the “right-side car”), however there is ample space inthe right lane behind the right-side car if the subject vehicle can getthere. The system first consults the “often used” maneuvers for thistype of hazard, and finds a maneuver to change lanes while avoidingtraffic there. With the kinetic model, the system varies and adjusts asequence of accelerations to enable a quick lane change, and addsindirect mitigation steps. A harm-minimization strategy is not preparedbecause the kinetic model indicated that the strategy of FIG. 16 wouldsucceed in avoiding a collision.

As listed in the figure, the steps of the strategy are first to,essentially simultaneously, (1 a) illuminate the brake lights of thesubject vehicle to alert the following driver and hopefully prompt thefollowing driver to stop gaining on the subject vehicle, (1 b) applybraking at the maximum level consistent with the vehiclecapability-data, and (1 c) inform the subject vehicle driver that anemergency intervention has begun, perhaps with a computer-spoken messageor other signal. The horn is not sounded because doing so might causethe right-side car driver to slow down in response, which is exactly notwhat is wanted at that time. Instead, the external sensors continue tomonitor the position of the right-side car while the subject vehiclerapidly decelerates, and as soon as the subject vehicle is sufficientlybehind the right-side car, (2 a) the brakes are released for beststeering control, and (2 b) the subject vehicle is steered to the rightat 20 degrees.

As soon as the subject vehicle has fully entered the right lane, thestrategy continues to (3 a) steer left at 20 degrees, thereby executingan “S-turn” into the lane, and (3 b) apply the brakes but not too hard,just to straighten out in the lane and also open up some space betweenthe subject vehicle and the right-side car. Then, when the subjectvehicle has become straightened in the lane, (4 a) the brakes are fullyreleased, (4 b) the subject vehicle steering is adjusted for lanecentering, (4 c) the brake lights are turned off, and (4 d) the subjectvehicle driver is informed that the intervention is complete and thedriver may resume control. However, the system continues to drive thesubject vehicle, straight and steady, until the driver takes an actionsuch as tapping the accelerator, thereby indicating to the system thatthe driver is ready to take over. At that point the system (5 a) stopscontrolling the vehicle and resumes monitoring traffic for futurehazards.

FIG. 17 is a table showing a variety of adjustment means according topresent principles, and exemplary settings associated with eachadjustment means. For example the adjustment means may be a toggleswitch, in which case there are usually just two settings: toggle up andtoggle down. However, some toggle switches have three positions, andthus three settings.

The adjustment means may be a knob which may be turned, may haveclick-stop positions or may be continuously adjustable, may be asingle-turn or multi-turn knob, may control a parameter in a linear orlogarithmic or other relationship, and may have further features such aspull-to-turn or push-to-set for example. The exemplary settings may befully clockwise, corresponding to a maximum value for the parameter thatthe adjustment means control; or fully counter-clockwise for a minimumvalue, or half-way around for an intermediate value.

A simple adjustment means may be a pair of buttons. Perhaps the buttonsturn a feature on and off, the first button causing the feature to beturned on and the second button to turn it off. Alternatively, aparameter may have a wide range of values such that the first buttonincreases the value while the second button decreases the value.

A slider adjustment provides continuous settings or click-stop settingsdepending on its construction. The slider may select how long the systemwaits after detecting an imminent collision, before applying anintervention. For example the slider may be set full-left, therebycausing the system to intervene with zero delay; or full-right, for adelayed intervention of, say, 3 seconds; or an intermediate position toselect a pre-set time delay preferred by the driver.

The adjustment means may be a voice-controlled selector which the driveradjusts by speaking. Probably the driver has to say particular wordsthat the system understands. For example the driver could say “increaselevel” to increase a particular setting such as a threshold fordetecting an imminent collision, or “decrease level” to lower thatthreshold. Developers employing the present principles will arrange manyother adjustment means and associated settings without departing fromthe claimed matter.

FIG. 18 is a table showing how different degrees of assistance may berelated to exemplary settings of an adjustment means, with typicalactions according to present principles. First, a low degree ofassistance may be selected by setting an adjustment means at a positionmarked “Warn only”, in which case the system would warn the driver if acollision is imminent but would not intervene. A skilled and alertdriver who does not want the automatic system to take over in anemergency may select that setting.

Second, a medium degree of assistance, labeled “Relinquish on demand”,causes the system to provide the imminent-collision warning, and also toassume control of the vehicle. However, the system would relinquishcontrol back to the driver if the driver asserts control by, forexample, forcefully operating the steering wheel or accelerator orbrakes in contravention to the system control. Or, the driver couldassert control by pressing a button on the steering wheel, or byspeaking a phrase that the processor could interpret such as “Relinquishcontrol!”.

Third, a high degree of assistance with the setting “Intervene untilsafe” would provide the warning message and system takeover, but wouldnot relinquish control until the strategy has been implemented and allhazards have been cleared.

FIG. 19 is a schematic of a system according to present principlescomprising one or more sensor 1900 and one or more processor components1901-1906. The sensor(s) 1900 acquire sensor data on a second vehicleproximate to the subject vehicle, and transmit the sensor data to afirst processor component 1901, which calculates (“calc.”) the positionor velocity or acceleration of the second vehicle. The second processorcomponent 1902 analyzes the position, velocity, or acceleration data,thereby detecting an imminent collision. The third processor component1903 then calculates one or more sequences, comprising periods ofpositive acceleration or deceleration or steering of the subjectvehicle, to avoid the collision and/or to minimize its harm. The fourthprocessor component 1904 then determines if the collision can be avoidedaccording to each of the sequences, and a fifth processor component 1905selects an avoidance sequence or a harm-minimization sequenceaccordingly. Finally, a sixth processor component implements thesequence by sending control signals to the subject vehicle's means foracceleration, deceleration, and steering.

FIG. 20 is a schematic of an alternative system according to presentprinciples. As before, sensors 2001 acquire sensor data on the secondvehicle. In addition, processors 2002 are programmed to perform a methodcomprising: determining (2003) the position, velocity, or accelerationof the second vehicle from the sensor data; then determining (2004)whether a collision is imminent; then calculating (2005) sequences ofaccelerations, decelerations, and/or steering of the subject vehicle toavoid the collision or to minimize its harm; then determining (2006)whether the collision is avoidable if the subject vehicle is acceleratedaccording to any of the sequences; then selecting (2007) either acollision-avoidance sequence or a harm-minimization sequenceaccordingly; and finally implementing (2008) the selected sequence bysending control signals to the subject vehicle throttle or brakes orsteering.

FIG. 21 is a schematic of yet another embodiment of a system accordingto present principles, again comprising sensors 2101 and processors 2012programmed to perform a method. Here the method includes determining(2103), from the sensor data, the position or velocity or accelerationof the second vehicle. If the sensor data indicates that a collision isimminent (2104), then one or more sequences are calculated (2105) toavoid the collision or to minimize harm. If the calculations indicatethat the collision is avoidable (2106), then the successfulcollision-avoidance sequence is implemented (2107). Otherwise, the bestharm-minimization sequence is implemented (2108).

FIG. 22 is a schematic of yet another version of a system according topresent principles. Sensors 2201 acquire sensor data on the secondvehicle and transmit it to processors 2202 programmed to analyze thesensor data to determine (2203) the position or velocity or accelerationof the second vehicle. If (2204) the collision is imminent, theavoidability of the collision is determined (2205) according tosequences of acceleration up to the maximum acceleration, ordecelerations up to the maximum deceleration, or steering up to themaximum rate of steering, that the subject vehicle is capable of. Then acollision-avoidance strategy is calculated (2207) if the collision isavoidable, or a harm-minimization strategy is calculated (2006) ifotherwise, and the calculated strategy is then implemented (2208).

It is understood that the foregoing description is that of the preferredembodiments of the invention and that various changes and modificationsmay be made thereto without departing from the spirit and scope of theinvention as defined in the appended claims.

1. A vehicle control system comprising: an automated driving controllerconfigured to execute at least partially automated driving in whichacceleration, braking and steering of a vehicle is at least partiallyautomatically controlled; wherein the controller is configured to:select one of a plurality of post-collision strategies in the event of acollision, the selection based on a determination of whether a driver isresponsive or unresponsive, and execute the selected strategy using oneor more controlled accelerations, or one or more controlleddecelerations, or one or more controlled steering movements, or acombination of the one or more controlled accelerations, decelerations,or steering movements.
 2. The vehicle control system according to claim1, further comprising one or more seat sensors configured to determinewhat seats occupants of the vehicle are sitting in, wherein theautomated driving controller is configured to control execution of theautomated driving in part based on the seats determined to haveoccupants.
 3. The vehicle control system according to claim 1, whereinthe seat sensor detects seat loading or seat belt use.
 4. The vehiclecontrol system according to claim 1, wherein the automated drivingcontroller is configured to execute an automated driving mode which isselected from a plurality of automated driving modes having differentdegrees of automated driving.
 5. The vehicle control system according toclaim 4, wherein if the driver is responsive, the automated drivingcontroller provides a lesser degree of automated control than if thedriver is unresponsive.
 6. The vehicle control system according to claim1, wherein the driver is determined to be responsive upon detection ofoperation of the steering wheel or accelerator or brake.
 7. The vehiclecontrol system according to claim 1, wherein the driver is determined tobe not responsive upon detection of no operation of the steering wheelor accelerator or brake.
 8. The vehicle control system according toclaim 1, wherein the driver is determined to be responsive upondetection that a predetermined operation has been performed by anoccupant of the vehicle.
 9. A vehicle control method causing an onboardcomputer to perform: controlling automated driving with an automateddriving controller using a processor configured to execute automateddriving in which acceleration, braking and steering of a vehicle is atleast partially automatically controlled; selecting one of a pluralityof post-collision strategies in the event of a collision, the selectionbased on a determination of whether a driver is responsive orunresponsive; and executing the selected strategy using one or morecontrolled accelerations, or one or more controlled decelerations, orone or more controlled steering movements, or a combination of the oneor more controlled accelerations, decelerations, or steering movements.10. The vehicle control method according to claim 9, further comprisingusing one or more seat sensors to determine in what seats occupants ofthe vehicle are sitting, and controlling execution of the automateddriving in part based on the seats determined to have occupants.
 11. Thevehicle control method according to claim 9, wherein the seat sensordetects seat loading or seat belt use.
 12. The vehicle control methodaccording to claim 9, wherein the automated driving controller isconfigured to execute an automated driving mode which is selected from aplurality of automated driving modes having different degrees ofautomated driving.
 13. The vehicle control method according to claim 12,wherein if the driver is responsive, the automated driving controllerprovides a lesser degree of automated control than if the driver isunresponsive.
 14. The vehicle control method according to claim 9,further comprising determining the driver to be responsive upondetecting operation of the steering wheel or accelerator or brake. Thevehicle control method according to claim 9, further comprisingdetermining the driver to be unresponsive upon detecting no operation ofthe steering wheel or accelerator or brake.
 16. The vehicle controlmethod according to claim 9, wherein the driver is determined to beresponsive upon detection that a predetermined operation has beenperformed by an occupant of the vehicle.